Add & remove missing/spybot wont install

Discussion in 'adware, spyware & hijack cleaning' started by Mcsparky, Mar 30, 2004.

Thread Status:
Not open for further replies.
  1. Mcsparky

    Mcsparky Guest

    Ok, I have a strange problem. I was working on a computer yesterday that was loaded with spyware. First thing I noticed was lots of spyware programs on the C: drive. Took a look in Add and Remove programs and nothing at all is showing up in the add and remove. Installed Ad-aware 6.0 retrieved updates and ran scan. Removed over 500 spyware programs but there is still some installed. Tried to install Spybot Search and destroy from CD and download both times failed stating something in the registry was corrupt. Some of the spyware programs that ad-aware is not removing I am pretty sure Spybot search and destroy will but I can not get it installed. Programs like Mysearch... can't remember the others. Can not see anything (no contents at all) in the Windows ME add and remove programs. Is there a type of virus or spyware program that could be preventing the spybot from installing or making the add and remove contents not show up?
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi McSparky,

    Please have a look here and go straight to Step2:
    http://www.wilderssecurity.com/showthread.php?t=15913

    There is one hijacker that can prevent Spybot S&D from opening any windows, but we might as well have a decent look before jumping to conclusions.

    Regards,

    Pieter
     
  3. Mcsparky

    Mcsparky Guest

    I do not have access to the computer anymore but for future what is the hijacker that prevents spybot from running and would that be causing the contents of add and remove from not showing up? I will contact the owner of the computer and see If I can work on it somemore.
     
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    One variant of CWS ( http://www.spywareinfoforum.com/~merijn/cwschronicles.html ) closed the Windows of several anti Spyware utilities.
    The downloadlink for the cure can be found at the page I linked to under Epilogue.

    There are several reasons why the Add/Remove list could be empty, inaccessible, disappeared or otherwise gone. ;)

    Hard to tell without a bit more insight into what is going on. I'd rather wait for a HijackThis log then guess for it.

    Regards,

    Pieter
     
  5. mcsparky

    mcsparky Guest

    I did scan the computer with CWshreder in normal mode (not safemode) and the scan came back saying the computer was not infected with CWS. should I have run it while computer was in safemode too?

    There are several reasons why the Add/Remove list could be empty, inaccessible, disappeared or otherwise gone.
    ....could you please give a little more detail. There are lots of programs installed on this computer that should be showing up in the add and remove but it shows nothing. I can not guarentee I will be able to get back to this computer to give you a hijack this log so I am just trying to provide myself with enough information to be more prepared in the future.
     
  6. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,330
    Location:
    Netherlands
    Hi mcsparky,

    A part of the registry can have been erased.
    You can check by going to this key:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

    The entries there are the ones that should be listed in Add/Remove Software.

    But look here for a lot of other possibilities: http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=add%2Fremove+software+empty&sa=N&tab=wg

    If CWShredder says you are clean in normal mode it will be no use to run it in Safe mode.

    Regards,

    Pieter
     
  7. mcsparky

    mcsparky Guest

    Thanks for the info.
    I will post a hjt log if I ever get back to it.
     
Thread Status:
Not open for further replies.