MRU blaster has stopped cleaning temporary Internet files only cookies??

[keystagegolf]

Hi, As of a couple of days my MRUblaster has stopped cleaning temporary internet files it only runs on cookies and then g¡ves me the "congratulatiions message". Even after I reboot the files are still there. I've been using it for the past 6 months without problem. Has there been any upgrades or changes? Appreciate any advice. Thanks.
keystagegolf

[TopperID]

Presumably you are refering to the plug-in for removal of TIFs from IE?

Has the file path changed? You can see what path is being cleaned by going to the configuration section of the relevant plug-in.

I'm just guessing, but it is possible that if you have recently installed the new IE7 the TIF path may have changed. Perhaps you could check; at the moment I'm still running IE6 so I personally don't know whether there are problems with MRUBlaster and IE7.

[keystagegolf]

Thank you for your reply, Yes I have upgraded to IE7 and it's since then that I noticed the problem.
Everything is checked except "customise notifications past items" and on the IE cleaner plug in "enable secure deletion of files" is checked, "Custom pass" is checked to 10 and "enable automatic IE temporary Internet delete" is also checked. Nothing was changed after the upgrade to IE7 except the function.
Should I try to uninstall and re install?:(

[TopperID]

When you go to MRUBlaster's settings section for the TIF plug-in, do you see the detected filepath displayed as in my screenshot?

If not then it is not detecting the TIF cache in IE7. A bit of Googling suggests to me that there have been some bugs as to the location of the TIF cache in IE7 which could explain the problem:-

http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.internetexplorer.general&tid=85c417ab-7621-4ee4-84cc-430cbcc167fa&cat=en_us_28cca3eb-7037-4d4f-bde1-d8efee1f1420&lang=en&cr=us&sloc=en-us&m=1&p=1

In the beta forums I saw it suggested that IE7 was storing TIFs at more than one location, which could also be the reason, but I'm afraid I can't check because I uninstalled IE7 after about 10 minutes use, because I hated it, and I'm back using IE6 for the moment until the dust settles!

[keystagegolf]

Thank you again for replying. I have checked the detected file path and it shows the correct one, on each of three users on this computer. The owner position changes according to who is logged on and trying to use the MRU blaster.

[keystagegolf]

Hello again, I have also just downloaded the software again to update it and the problem remains the same. No deletion of temporary Internet files.

[Bubba]

Nothing basically has been changed concerning MRUblaster and IE7 and while this does not yet help your situation....I have confirmed IE and MRUblaster both see my TIF in the below location and after re-boot MRUblaster did clean the TIF.

C:\Documents and Settings\..~username~..\Local Settings\Temporary Internet Files

Couple things to consider\check:

1) If you go to IE\Tools\Delete Browsing History\TIF....select Delete Files. If you then open Windows Explorer....are the files actually cleaned in the TIF Current location: ?

2) In regards to MRUblaster and TIF cleaning....it does this by placing a RunOnce entry into the LocalMachine portion of the registry which requires Admin priveligies.

Questions:

Do these users have Admin priveligies or do you use a registry monitoring program that might be blocking the below entry from being written to the registry ?


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
"MRUBlaster"="D:\\Program Files\\MRU-Blaster\\indexcleaner.exe -CACHE"

[keystagegolf]

(1) I have confirmed that the Temporary Internet and cookies can be deleted through Internet options/browsing history. Also checked that they have actually been removed from the TIF folder.

(2) Both users have administration rights, but I am not sure how to check the registry for the MRU blaster.
If I need to do something in the registry please walk me through it. Thanks.

The IE deletion of TIF's is working but the MRU blaster is not.

[Bubba]

-{ Quote: "I am not sure how to check the registry for the MRU blaster. If I need to do something in the registry please walk me through it. Thanks." }-To look in the registry for that entry go to Start button\Run and type regedit in the Open: box and then select Ok. Once the Registry editor is open then click on the + sign next to the below keys until you get to the RunOnce key. When you click on that key you should then see what is being displayed in the above pic concerning X:\\Program Files\\MRU-Blaster\\indexcleaner.exe -CACHE

+ HKEY_LOCAL_MACHINE
+Microsoft
+Windows
+CurrentVersion
RunOnce

-{ Quote: "I've been using it for the past 6 months without problem....I have upgraded to IE7 and it's since then that I noticed the problem." }-What did you do 6 months ago in April to fix the problem....if you did....before IE 7 came out :-\

Your older thread---> the MRU Blaster is not working! (http://www.wilderssecurity.com/showthread.php?t=124777)

[keystagegolf]

Attention BUBBA, Thank you for your walkthrough. I followed your instructions and the display at "runonce" is C;\Program Files\MRU Blaster\indexcleaner.exe COOKIES.
Temporary Internet files does not show up anywhere!!

As far as the problem 6 months ago. I didn't do anything.

[Bubba]

-{ Quote: " Attention BUBBA, Thank you for your walkthrough. I followed your instructions and the display at "runonce" is C;\Program Files\MRU Blaster\indexcleaner.exe COOKIES.
Temporary Internet files does not show up anywhere!!" }-Well We then have to figure out what is preventing the Program Files\\MRU-Blaster\\indexcleaner.exe -CACHE entry from being added to the registry. Unless that entry gets added their is no cleaning on re-boot :-\

Would you mind listing all of your Security\Privacy programs installed Please....especially any that might be blocking AutoStart registry entries.

Bubba

[keystagegolf]

I have just checked the registry again on the other user side and there is nothing about MRU blaster on the runonce position it reads REG_SZ (value not set)

Something very strange has happened now on the first user side(both have admin rights) the reading at runonce is also REG_SZ (value not set) the desciption about indexcleaner.exe COOKIES has disappeared!!

Please advise. Thank you.

[keystagegolf]

Here is a HIJACK this scan which should list all the security software on the computer. Hope this is what you want, There maybe stuff that I'm not aware of. If this is not useful please come back. Thanks.

~removed HJT log....Bubba~

[Bubba]

I have removed the HJT log because at this moment in time it's not something We need but if needed I will be asking for it as per our policy (http://www.wilderssecurity.com/showthread.php?t=42148).

Some of the programs I see installed are AVG Anti-Spyware 7.5, ZoneAlarm. Are there any others not listed that you have installed ?

What I would like for you to do is open MRUblaster and select Settings\Go to Plugins....open either the Cookie or TIF plugin and then select Save Settings + Run Now. Then follow the earlier posted instructions about going to the RunOnce registry location and according to which plugin you chose.....there should be an entry ?

Cookie....Program Files\\MRU-Blaster\\indexcleaner.exe -COOKIES

TIF....Program Files\\MRU-Blaster\\indexcleaner.exe -CACHE

If you selected both it should be....

Program Files\\MRU-Blaster\\indexcleaner.exe -CC

[keystagegolf]

Can we continue tomorrow as It's 02.00 AM and I'm off to bed now. Thanks for your help so far. Best regards.

[Bubba]

-{ Quote: "Can we continue tomorrow" }-Negative....We have to stay up all night :o

Have a good evening. We'll still be here anytime that you are able to come back.

Bubba

[keystagegolf]

Good afternoon BUBBA,

Here is a list of all that's on my computer:AdAware/CWshredder/Spybot search and distroy/AVG anti-virus & AVG anti-spyware/Spyware blaster/Spamihiliator(but its not running)/windowsDefender(also not running)/Zonealarm Firewall.

I did the test you set me as follows:Went to MRUblaster plug ins TIF and the registry showed \indexcleaner.exe-CC and the MRUBlaster did run to clean the TIF's and after a reboot the file was clean. Its appears to be OK now. STRANGE. That's what happened 6 months ago it corrected it's self.
I'll watch it during the next few times I'm on and keep you posted.
I really do appreciate how much time you give to helping people like me. Thanks.
Please let me know if I should do anything else. ;D

[Bubba]

-{ Quote: "I did the test you set me as follows....and after a reboot the file was clean....Thanks" }-You're very Welcome :thumb:

-{ Quote: "Here is a list of all that's on my computer:AdAware/CWshredder/Spybot search and distroy/AVG anti-virus & AVG anti-spyware/Spyware blaster/Spamihiliator(but its not running)/windowsDefender(also not running)/Zonealarm Firewall." }-
-{ Quote: "I'll watch it during the next few times I'm on and keep you posted. Please let me know if I should do anything else. ;D" }-What I suggest you be watching for is one of your programs blocking\disabling the RunOnce entry. Take for instance "Spybot search and distroy" and it's TeaTimer feature. I noticed in your HJT log that is not running resident. If someone comes along and enables the TeaTimer feature....make sure it does not attempt to block RunOnce entry addition or already have a RunOnce blocked attempt saved.

Regards,
Bubba

[keystagegolf]

Good afternoon BUBBA,
Unfortunately the problem is still with me but I have some more data which perhaps you can review.

The MRU Blaster operation is changing the registry from one user to another. By that I mean that following your instruction, SETTINGS/PLUGINS/SAVE SETTINS AND RUN. on one of the user sides the registry shows: indexcleaner.exe-CC and it works to remove the files after reboot. BUT when I go to the other user side the registry RUN ONCE shows no reading at all. If I then go through the above proceedure I can make the MRU blaster work on the second side.

Question? Is the MRU B software only able to operate for one user of the computer??

[keystagegolf]

Hello BUBBA,

Some more information. Using the MRU blaster on only one side I have noticed the following: Checking the registry to be sure the ......-CC is there I delete TIF's/reboot and the TIF's have been errased but the cookies are still there(as expected)/ now go to the registry and there is no MRU info. The software is deleting itself from the registry after running??!!
I guess this should not be happening. Is there anything I can do to stop it?:-\

[Bubba]

-{ Quote: "The MRU Blaster operation is changing the registry from one user to another. By that I mean that following your instruction, SETTINGS/PLUGINS/SAVE SETTINS AND RUN. on one of the user sides the registry shows: indexcleaner.exe-CC and it works to remove the files after reboot. BUT when I go to the other user side the registry RUN ONCE shows no reading at all. If I then go through the above proceedure I can make the MRU blaster work on the second side.

Question? Is the MRU B software only able to operate for one user of the computer??" }-The "MRU B software" can work for as many users that you have created provided they have Admin priveligies as mentioned in an earlier post above.

-{ Quote: "BUT when I go to the other user side the registry RUN ONCE shows no reading at all." }-The Windows RunOnce key is used when you want to run something one time....hince the registry key name RunOnce. Upon re-boot after the action is taken....the RunOnce entry is removed.

It's important to note once again that users have to have Admin priveligies or permission to write to the registry keys needed for MRUblaster to function properly.

These keys are:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\MRU-Blaster\CookieBlaster
HKLM\SOFTWARE\MRU-Blaster\IECache

The two MRU-BLASTER keys above is where the user info is stored.

For example....user Bubba selects both plug-ins and Bubba has Admin priveligies or permission to write to the registry keys listed above.

Keys written to and associated user info:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce....Program Files\\MRU-Blaster\\indexcleaner.exe -CC
HKLM\SOFTWARE\MRU-Blaster\CookieBlaster....D:\Documents and Settings\Bubba\Cookies
HKLM\SOFTWARE\MRU-Blaster\IECache....D:\Documents and Settings\Bubba\Local Settings\Temporary Internet Files


Bubba re-boots....the RunOnce entry cleans TIF\Cookies....RunOnce entry is removed but the MRU-Blaster entries remain.

UserTwo comes along....selects both plug-ins and has Admin priveligies or permission to write to the affected registry keys.

Keys written to and associated user info:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce....Program Files\\MRU-Blaster\\indexcleaner.exe -CC
HKLM\SOFTWARE\MRU-Blaster\CookieBlaster....D:\Documents and Settings\UserTwo\Cookies
HKLM\SOFTWARE\MRU-Blaster\IECache....D:\Documents and Settings\UserTwo\Local Settings\Temporary Internet Files

**Suggest you attempt again with 2 users....check that the above is written to the registry after each user selection with the proper MRUblaster info and see what happens.

If it does not work and each user has Admin priveligies or permission to write to the registry keys needed for MRUblaster to function properly....then something else besides MRUblaster is functioining improperly or there is a registry blocking program in effect.

Bubba

[keystagegolf]

Thank you for your reply.
Admin. privileges has never been an issue both users have AP.

Having gone through the proceedures dozens of times I can say that the MRU Blaster works only 50% of the time. Sometimes after clicking plugins Temp I F's/save settings and run, it does not write to the registry! Other times it does. Also sometimes the "download type bar" shows that the cookies are being removed but it does not appear to show TIF's are being removed.
The keys HKLM/SOFTWARE/MRU BLASTER/Cookie blaster &
/IECache are always there.
In addition following your proceedures closely and rebooting, the files are still there. Repeating the operation after reboot they are gone!?
Summarizing the MRU Blaster is not working as it should.
I have tried to uninstall it through add/remove programs but it remains in the registry under MRU Blaster just after Microsoft.
How can I remove it completely, to reinstall in the event that the earlier install was not correct. I'm sure it does work, but at the moment not on my computer.
Probably it has never worked properly and I have only just realised it.
Any advice will be much appreciated. Thank you.:'(

[JDoe]

IS THERE ANYTHING I CAN DO TO GET TO IT WORKING. START AN INSTALLATION AGAIN PERHAPS.

THIS POST HAS THE SAME PROBLEM IT SEEMS!

[keystagegolf]

I am continuing to try and get the MRU Blaster working on my computer.

I have cleared the registry, add/remove programs,firewall and seached to clean the computer of previous MRU Blaster downloads.
Then disconnected the firewall and anti-virus and downloaded MRU Blaster again.
Then checked the registry as previously directed this is what appears:
HKLM/software/MRU Blaster/Cookies Blaster
HKLM/software/MRU Blaster/Scheduler
Temporary Internet files does not appear!?
Then going further to:
HKLM/software/Microsoft/Windows/CurrentVersion/Runonce. On the right side appears C:\program files\MRU Blaster\indexcleaner.exe-COOKIES.

Nowhere does Temporary Internet files appear!!

Am I doing something wrong?? Thank you. I really am trying to get to the bottom of the problem.

Please help:(

Keystagegolf

[Bubba]

-{ Quote: "I have cleared the registry....

Then checked the registry as previously directed this is what appears:
HKLM/software/MRU Blaster/Cookies Blaster
HKLM/software/MRU Blaster/Scheduler" }-We may come back to this later but if the registry was cleared then those MRU-Blaster keys should not be present :-\

What I would ask you to do is log onto one of these accounts that you are having this issue with. Then open MRUblaster and select Settings\Go to Plugins....open the Cookie and TIF plugins and select Save Settings + Run Now.

As soon as you have done that:

Click Start button > Run > and copy the below bold command into the window exactly:

regedit.exe /e C:\mru.txt "HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster"

Click OK to execute that command. If done correctly this will create the file C:\mru.txt

Find that file and post the contents Please.

If when doing that any of your programs issue a warning or what not Please make note.

Bubba

[keystagegolf]

Did exactly as you advised. First message"are you sure you want to add to registry" Clicked OK then second message "Cannot import e: Error opening the file. There may be a disk or file system error. Clicked OK
Third message "Are you sure you want to add the information in C:\mru.txt to the registry". Clicked OK Fourth message cannot import etc last try to import HKEY local etc failed.

[Bubba]

-{ Quote: "Did exactly as you advised." }-If you copied the whole portion I had in bold exactly....it should not be attempting to add anything....only exporting that info and placing it in a file called mru.txt

Just to make sure....what hard drive letter is your system working from ?

[keystagegolf]

C:\ drive

[Bubba]

-{ Quote: "C:\ drive" }-Then you have issues other than MRUblaster that's for sure especially if those type error messages are coming back from a simple regedit extract command. You can double check you have copied\pasted exactly as advised and try again....otherwise I'm about out of ideas what is wrong with your system but it's not MRUblaster IMMHO.

By chance did you look in the root of C: drive and did you see the mru.txt file ?

Bubba

[keystagegolf]

I have tried again by copy and paste and can see in "my computer" the file mru text document. On opening I see: MRU-Blaster, Cookies Blaster,Scheduler

[Bubba]

-{ Quote: "I have tried again by copy and paste and can see in "my computer" the file mru text document. On opening I see: MRU-Blaster, Cookies Blaster,Scheduler" }-As requested above....will you post the contents Please....all of the contents.

-{ Quote: "Take your mouse pointer to the beginning of the text you want to copy and hold down your left mouse button (that's the one you normally use). Then drag the mouse pointer to the end of the text you want to copy. This highlights it. Let go of your left mouse button. While holding your mouse pointer over some of the highlighted text you will need to click your right mouse button (that's the one you don't normally use) and a menu will pop up. Go down until "copy" is highlighted then click on it." }-

[keystagegolf]

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster]

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\CookieBlaster]
"Location"="C:\\Documents and Settings\\Ken Admin\\Cookies"

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\Scheduler]
"Scan Interval"=dword:0000000f
"Minutes"=hex:ff,ff
"Seconds"=hex:00,00
"Hours"=hex:00,00

[Bubba]

Thank You.

Well....if you actually went to the TIF plugins and selected Save Settings + Run Now as requested above....then some software you have is preventing or has prevented the MRU-Blaster\IECache key to be written.

If you indeed did the TIF plugin and have not re-booted the machine:

Click Start button > Run > and copy the below bold command into the window exactly:

regedit.exe /e C:\mru.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"

Click OK to execute that command. If done correctly this will create the file C:\mru.txt

Find that file and post the contents Please....all the contents.

Thanks,
Bubba

[keystagegolf]

Hello Bubba, I just lost my internet connection so I don't know what you received here is the copy of the mru file.


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster]

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\CookieBlaster]
"Location"="C:\\Documents and Settings\\Ken Admin\\Cookies"

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\Scheduler]
"Scan Interval"=dword:0000000f
"Minutes"=hex:ff,ff
"Seconds"=hex:00,00
"Hours"=hex:00,00

[Bubba]

-{ Quote: "Hello Bubba, I just lost my internet connection so I don't know what you received here is the copy of the mru file." }-Sorry about your Interent connection. Is that the contents of mru.txt after accomplishing the request in post # 34 above ?

If so....then delete that mru.txt file and accomplish the request in post # 34 above Please.

[keystagegolf]

I'm back with you,

indows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MRUBlaster"="C:\\Program Files\\MRU-Blaster\\indexcleaner.exe -COOKIES"

[Bubba]

Please don't think I am harping but I have to ask....did you actually go to the TIF plugins and select Save Settings + Run Now as requested above ?

That RunOnce entry should say....Program Files\\MRU-Blaster\\indexcleaner.exe -CC....if you indeed selected both of the plugins as requested earlier.

[keystagegolf]

This is the post after pasting from 34 above. I have been again to the plugins selected save settings +run on both TIF's and cookies.
and repeated the pasting of 34
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MRUBlaster"="C:\\Program Files\\MRU-Blaster\\indexcleaner.exe -COOKIES"
-----------------------------------------------------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MRUBlaster"="C:\\Program Files\\MRU-Blaster\\indexcleaner.exe -COOKIES"

[Bubba]

Well...well....I am about out of ideas :blink:

If you wish to try one other thing then I'll ask you to go into the registry and delete any entries dealing with HKLM/software/MRU Blaster and also remove the MRUblaster entry from the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce key....reboot and after you re-boot....go into the registry and make sure the keys and entries were actually removed. If they were not say so....but if they were then I'll ask that you run the TIF plugin and select Save Settings + Run Now.

As soon as you have done that:

Click Start button > Run > and copy the below bold command into the window exactly:

regedit.exe /e C:\mru.txt "HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster"

Click OK to execute that command. If done correctly this will create the file C:\mru.txt

Find that file and post the contents Please.

Bubba

[keystagegolf]

I have rebooted and the HKLM/software MRU Blaster is still there as is the runonce key.

I am going to bed now. Thank you for your help today. I'll catch up with you tomorrow.

[keystagegolf]

Good morrning Bubba,
I was a bit tired last night so I'll explain in more detail what happened.
I deleted as instructed and rebooted to see where still there.
HKEY/LOCAL MACHINE/MRU BLASTER/Cookieblaster &
HKEY/LOCAL MACHINE/MICROSOFT/WINDOWS/CURRENTVERSION/RUNONCE shows: C:\program files\MRU Blaster\indexcleaner.exe.-COOKIES
There is no sign of Temporary Internet files anywhere?!
A new developement is that the MRUB scheduler comes up when I start now with "Scheduling disabled".
My firewall allows MRU Blaster v1.5 and scheduler access to trusted & internet but not Server.

Hope this helps.

P.S. I'm going to try the whole proceedure again after I post this.

[keystagegolf]

Tried again but the items are restored on reboot.
Also went to plugins TIF's selected "save settings + run now" and checked the registry but TIF don't show up anywhere.:(

[Bubba]

-{ Quote: "Tried again but the items are restored on reboot." }-Since it is important that I not mis-understand....are you saying that when you remove the below items in bold and then re-boot....those entries are still present right after re-boot ?

-{ Quote: "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MRUBlaster"="C:\\Program Files\\MRU-Blaster\\indexcleaner.exe -COOKIES"

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\CookieBlaster]
"Location"="C:\\Documents and Settings\\Ken Admin\\Cookies"

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\Scheduler]
"Scan Interval"=dword:0000000f
"Minutes"=hex:ff,ff
"Seconds"=hex:00,00
"Hours"=hex:00,00" }-

If that is the case We are back to where I was in my first post....it's either a user rights problem or one of your programs is preventing action happening to the HKLM hive which requires Admin rights. Until you can isolate which of your programs is preventing this....discussing MRUblaster is mute.

I would suggest you attempt to disable all of your Security\Privacy programs even if it means disconnecting from the Interent and disabling your firewall. If you do not know which of your programs monitors the registry....removing them from the equation is the only way. Until you can succesfully remove those above entries I mentioned with one of your programs placing them back in there....then it is useless to find out if MRUblaster is doing something wrong.

Hopefully others can assist you but I will be off line for a day or so....so good luck.

Bubba

[keystagegolf]

Hello Bubba, I'll leave this for whenever you come back on line.

I have made a minor improvement. Found "Smit rem" which also uses HKEY Local Machine/Software/Microsoft/Windows/Current Version/runOnce. It was picked up in a scan by Panda Active Scan and I deleted it. Now when I remove the items in your last post 30 November 06. and reboot they are not present. However when I go to plugins and click TIF's save settings + run now only the Cookies and scheduler are present in the registry.

I did shut down everything and disconnected from the Internet but its just the same. Panda active scan warned about "SpywareQuake" but I can't find it in the registry or on the hijackthis scan unless its hiding under numbers and not name.

Keystagegolf.

[Bubba]

If Panda is correct about SpywareQuake or you suspect malware infiltration taking into account the legitimate Smit rem cleaning tool already installed....you need to take care of this possible Smitfraud infection before concerning ourselves any further about MRUblaster. Your machine including all user accounts need to be checked by a malware expert.

Having said that and since Wilders no longer processes HJT logs as per this Announcement thread (http://www.wilderssecurity.com/showthread.php?t=42148)....I suggest you visit one of the sites contained in that announcement or one of the links below....

http://gladiator-antivirus.com/forum/index.php?showtopic=10517

http://www.dslreports.com/faq/13616

they give very good assistance with HJT analysis also. Please do follow all of their posting instructions and keep in mind it may take a bit to get thru the assistance so do find a time when you can stick with them fully until you are clean.

Once that is done and only when that is done will We be able to continue with this possible MRUblaster problem. Please supply the link to the thread where a malware expert is assisting you with your possible malware infection for follow-up by person.

Regards,
Bubba

http://www.bleepingcomputer.com/forums/topic73953.html

[keystagegolf]

Hello Bubba,

Well I have a completely clean PC thanks to the help of Calamity Jane at the Broadband forum that you recommended.
However the MRU Blaster still does not put a key in the registry to delete TIF's. Is there anything else you can advise??

Could the problem be with IE7 compatibility? Do you have contact with the programmer at javacoolsoftware their web site does not list MRU Blaster!?

Regards

Keystagegolf

[Bubba]

-{ Quote: "Hello Bubba,

Well I have a completely clean PC thanks to the help of Calamity Jane at the Broadband forum that you recommended." }-That is good to hear and without assuming wrongly....is this (http://www.dslreports.com/forum/remark,17400539) the thread where CJ helped you ?

-{ Quote: "However the MRU Blaster still does not put a key in the registry to delete TIF's. Is there anything else you can advise??" }-At the moment no....but will await your answer of the above question and if that is you....I want to take a closer look at a few items you posted.

-{ Quote: "Could the problem be with IE7 compatibility?" }-Speaking of only my installation of IE7....I have no problems with any software including MRUblaster.

As a side note from something you said earlier.... -{ Quote: "Went to MRUblaster plug ins TIF and the registry showed \indexcleaner.exe-CC and the MRUBlaster did run to clean the TIF's and after a reboot the file was clean. Its appears to be OK now. STRANGE. That's what happened 6 months ago it corrected it's self." }-That in itself makes my head hurt in trying to narrow it down because MRUblaster does not just correct itself. MRUblaster clearly works but something(3rd party program installed) is preventing it from working all the time or there is possibly some confusion on your part in regards to using MRUblaster for more than one user and I'll ask that you Please review post # 21 above.

Also....I will also ask that you go to each of the below registry locations....highlight the entries one at a time....right click an entry....select Permissions and tell me what the settings are for Full Control and Read Please.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster

Bubba

[keystagegolf]

Hello Bubba,
Yes you are correct about the thread with Calamity Jane.

Here are the answers to your second question:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. Full control is checked & Read is checked.


HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster Full control is checked &
Read is checked.

Although two users have admin rights only I am using the MRU Blaster, at least until it is working OK. There is no conflict that one is countering the others actions.


If it in interesting when I right click the key on runonce the value Modify comes up clicked it brings up Edit string-valuedata then C:\program files\MRU BLaster\indexcleaner.exe - cookies.
I have not changed anything.

[Bubba]

-{ Quote: "Although two users have admin rights only I am using the MRU Blaster, at least until it is working OK." }-Well hopefully before the year is out We can at least get it working properly on your account login :blink:

Having said that....I will ask that you have patience as I ask that We start all over with this process by attempting to remove everything related to MRUblaster in the registry and file system. If successful We will then start all over with an install for your account login only.

1) Un-install MRUblaster via Add/Remove programs and reboot.
2) Go to the below registry keys\file system locations and delete any left over entries that are in bold....there will be some. After removal of those below items re-boot and after re-boot carefully check that no registry keys or file system locations are still there. If there are entries left....Please post about that before We go any further.

delete:
registry key entries HKEY_CURRENT_USER\Software\MRU-Blaster
HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce....any MRUblaster entry

file system entries

C:\Program Files\MRU-Blaster
C:\Documents and Settings\All Users\Start Menu\Programs\MRU-Blaster
C:\Documents and Settings\~user~\Start Menu\Programs\Startup....look in every user folder including All Users and remove any MRU-Blaster entries

3) Re-boot and after re-boot carefully check that no registry keys or file system locations are present.
4) Log off your account that We have been working on and l log into the other accounts and delete any of the above mentioned registry key entries that you may find.

Bubba

[keystagegolf]

OK Bubba, we are completely free of MRU Blaster. Out of interest I used the start/search and it found an entry MRU Blaster.(numbers that I ommited to note down) and it is also deleted. Have rebooted and its clean.
Over to you again.
Regards

[Bubba]

-{ Quote: "OK Bubba, we are completely free of MRU Blaster" }-Kewl :thumb:

Install MRU-Blaster and during the install on the Select Additional Tasks part....un-check Start-up and Scheduler Options....continue with setup and when it gets to Completing Setup Wizard....un-check Run MRU-Blaster Scheduler to configure....leave the one about Run MRU-Blaster checked.

When MRU-Blaster opens select Settings\Go to Plugins\IE TIF Cleaner only. Then select Save Settings + Run Now.

Go into the registry and see if the below registry key is present along with the MRUBlaster data values.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C:\Program Files\MRU-Blaster\indexcleaner.exe -CACHE

Nothing more....nothing less Please.

Thanks,
Bubba

[keystagegolf]

Hello Bubba,

I have done exactly as you described with only me logged on to the computer.
There is no reference to MRU Blaster showing in the RunOnce location only (default) REG_SV (Value not set)

There is no MRU Blaster file in HKEY_Local Machine/Software

There is a file in HKEY_Current_user/Software/MRU Blaster-Ignore & Plugins-IE CacheClean

[Bubba]

-{ Quote: "Hello Bubba,

I have done exactly as you described with only me logged on to the computer." }-Thank You
-{ Quote: "There is no reference to MRU Blaster showing in the RunOnce location only (default) REG_SV (Value not set)

There is no MRU Blaster file in HKEY_Local Machine/Software" }- Ok....now open up MRU-Blaster and select Settings\Go to Plugins\Cookie Blaster only. Then select Save Settings + Run Now.

Go into the registry and see if the below registry key is present along with the MRUBlaster data values.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C:\Program Files\MRU-Blaster\indexcleaner.exe -COOKIES


Also....is the below registry key now present or is the MRU-Blaster key even present at all ?

HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\CookieBlasterNothing more....nothing less Please.

Thanks,
Bubba

[keystagegolf]

Yes the key exactly as you wrote is present

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C:\Program Files\MRU-Blaster\indexcleaner.exe -COOKIES

AND

The second key is also present
HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\CookieBlaster

ALSO CookieBlaster is now present with CacheClean :

HKEY_Current_User/Software/MRU Blaster/Plugins/CookieBlaster & IE CacheClean

[Bubba]

-{ Quote: "Yes the key exactly as you wrote is present

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
C:\Program Files\MRU-Blaster\indexcleaner.exe -COOKIES

AND

The second key is also present
HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\CookieBlaster

ALSO CookieBlaster is now present with CacheClean :

HKEY_Current_User/Software/MRU Blaster/Plugins/CookieBlaster & IE CacheClean" }-Thanks

Open note pad and copy the below exactly and name that file iecache.reg.
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\IECache]
Save that file to your desktop. After you have saved that file go to your Desktop....double click that file and answer Yes that you want to add that file. Then go into the registry and see if the below entry is now present in your registry.

HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\IECache

Nothing more....nothing less Please.

Thanks,
Bubba

[keystagegolf]

Hello Bubba,
Sorry for the delay. We are in a different time zone and I had to go out.

I followed your instructions BUT that entry is not in the register.

I answered Yes as you directed and a screen came up to say that "it has been entered". However it does not appear.

[Bubba]

-{ Quote: "I followed your instructions BUT that entry is not in the register" }-Hmmm....very interesting.

Please try this....Open note pad and copy the below exactly and name that file iecash.reg.
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\IECash]Save that file to your desktop. After you have saved that file go to your Desktop....double click that file and answer Yes that you want to add that file. Then go into the registry and see if the below entry is now present in your registry.

HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\IECash

Nothing more....nothing less Please.

Thanks,
Bubba

[keystagegolf]

Could not add to the registry quote "cannot import C:\............
The specified file is not a registry script"

[Bubba]

-{ Quote: "Could not add to the registry quote "cannot import C:\............
The specified file is not a registry script"" }-I will ask that you re-look at the instructions in post # 55 in regards to saving the file as a .reg file and double check your steps. This was no different than what We did in post # 55 except We changed IECache to IECash.

If it does not have the blue looking cube as an icon....then you are not saving it properly as a .reg file.

Bubba

[keystagegolf]

OK tried again sucessfully AND the entry is in the place

HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\IECache

;D

[Bubba]

-{ Quote: "OK tried again sucessfully AND the entry is in the place

HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\IECache" }-The IECache entry was entered successfully earlier but did not show up....correct :-\

I would ask that you delete the IECache entry and attempt to do it again. If after a few times of deleting and re-applying the IECache.reg file....IF you are successful each and every time....then thats fine but if it says "it has been entered" and you look and it's not there....that's very important to know.

If you haven't figured it out yet....this IECache.reg file We are importing is one way to find out if you have a problem with your registry and until that is figured out....working on a possible MRUblaster problem is counter productive.

Bubba

Edit

What I will ask you to do as you continue to troubleshoot this problem is to log into another Admin account....not Power user but an Admin account and starting with post # 51 above where it says When MRU-Blaster opens select.... attempt to do those steps on this other Admin account Please and any of the other steps you wish to accomplish. In and all of these same steps accomplished on the other Admin accounts would be very beneficial. If it comes down to it....your account might be the issue and you'll have to create another account if MRUBlaster for this account is important.

Bubba

[keystagegolf]

Hello Bubba,

I have followed the proceedure with another account from 51 to 55. After 55 the key HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\IECache
is present but when I highlight it there is no data on the right hand side of the page. Unlike when I highlight CookieBlaster there is an entry C:\documents and settings\pc\cookies.


When I open MRU Blaster/settings/go to plugins/TIF's/save settings and run. There is no "download style bar" shows and nothing in the registry. BUT when I go to MRU Blaster/settings/go to plugins/cookie Blaster/save settings and run.the "download style bar" shows the cookies being deleted and the data is in the runonce location.

The cookies part of the MRU Blaster is working as it should but not the TIF's.
on either user.

On the second user side in HKEY_CURRENT_USER\SOFTWARE\MRU \BLASTER\Plugins\IECacheClean. When I highlight the right hand side shows
AutomaticClean Reg_ Binary ff ff
SecureDelete REG_Binary ff ff

[Bubba]

-{ Quote: "I have followed the proceedure with another account from 51 to 55. After 55 the key HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\IECache
is present but when I highlight it there is no data on the right hand side of the page. Unlike when I highlight CookieBlaster there is an entry C:\documents and settings\pc\cookies." }-Unfortunately....since you did not list what you found after each procedure....post 51, 53, 55 and even 57....we are getting no where except further away from where the problem lies :-\

-{ Quote: "When I open MRU Blaster/settings/go to plugins/TIF's/save settings and run. There is no "download style bar" shows and nothing in the registry. BUT when I go to MRU Blaster/settings/go to plugins/cookie Blaster/save settings and run.the "download style bar" shows the cookies being deleted and the data is in the runonce location.

On the second user side in HKEY_CURRENT_USER\SOFTWARE\MRU \BLASTER\Plugins\IECacheClean. When I highlight the right hand side shows
AutomaticClean Reg_ Binary ff ff
SecureDelete REG_Binary ff ff" }-I put that quoted items together some what out of context to say this....

The AutomaticClean and SecureDelete entries should not be in the registry unless after this latest installation someone has checked the 2 boxes in the TIF plugin(Enable Secure Deletion.... and Enable automatic IE TIF delete....) and then selected Save Plug-in Settings....something that should have been done yet. OR....you did not remove them as requested in post #49 (http://www.wilderssecurity.com/showthread.php?p=901790#post901790) step 4).
In any case....since everything is not being removed properly....We are going in circles :blink:

Since you did not remove those entries....could it be you did not also remove the MRU-Blaster Silent Clean shortcut found in the Startup folder for this PC user as requested earlier :dry:

If you did not....then when you logged out of your account and signed in as the PC user....it's account on startup ran the MRU-Blaster Silent Clean shortcut found in it's Startup folder....which means due to the registry settings you found....it performed a secure deletion of the TIF. When you then went to "plugins/TIF's/save settings and run"....there was nothing to clean and you would not see the "download style bar" because it was already cleaned by the registry keys that were present.... that should not have been present :ouch:

-{ Quote: "The cookies part of the MRU Blaster is working as it should but not the TIF's" }-Once again....that has yet to be determined because troubleshooting suggestion procedures have not been followed properly....which makes it somewhat impossible for me to continue with this continous loop We seem to be in :-\

I wish you well in determing where your problem lies and if I have been a hendrance I appologize. There are times when one must step a side if there is a possibility they are doing more harm than good. I can assure you tho....there is enough info in the last so many pages to solve your issue....an issue that is not with MRUblaster IMMHO.

Good Luck,
Bubba

[keystagegolf]

Good day,

I would like to say that in your last EDIT you say and I quote

"and starting with post # 51 above where it says When MRU-Blaster opens select.... attempt to do those steps on this other Admin account Please "AND ANY OF THE OTHER STEPS YOU WISH TO ACCOMPLISH." As a result I did check- in the TIF plugin(Enable Secure Deletion.... and Enable automatic IE TIF delete and then selected Save Plug-in Settings. To see if the MRU Blaster was working.

Everything IS being removed properly and the rest of your remarks below down to the next quote do not apply.

I do appreciate that you have been very patience and I am at the point where the MRU Blaster has been loaded into the second user account.
I have removed the entries- AutomaticClean Reg_ Binary ff ff
SecureDelete REG_Binary ff ff from the registry and unchecked them in the plugins.
I have completed the early posts to completely remove MRU Blaster and followed your proceedures to the letter to reinstall MRU Blaster to the second user account.

The status of my computer in the second user account is : HKEY_CURRENT_USER\Software\MRU Blaster\Plugins\CookieBlaster
HKEY_CURRENT_USER\Software\MRU Blaster\Plugins\IECacheClean With no data on the right side when they are highlighted. AND
HKEY_LOCAL_MACHINE\Software\MRUBlaster\IECache nothing on the right side when highlighted
HKEY_LOCAL_MACHINE\Software\MRUBlaster\CookieBlaster shows C:\Documents and settings\pc\cookies AND
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runonce
shows on the rightside C:\Programfiles\MRUBlaster\indexcleaner.exe-COOKIES

There is no circle of unwanted actions at this moment and we are at the point where you wanted to be. Lastly I did not list what happened after the actions because everything went as you had described.

I hope you are able to advise what appears to be the last steps. Thank you

Keystagegolf

[keystagegolf]

Note to Bubba,

There is no need to reply to my last post of information. I, like you, have given up on MRU Blaster.
I have downloaded another product that works perfectly without having to rewrite the registry.
Thank you for all the time you spent trying to make it work.

Keystagegolf