-=PCTechTalk=- Re: IE Association Error

Folks,

I'm pleased to say that Connie has fixed her spyware problem, through 
private correspondance with myself. Here, for anyone suffering 
similar unbudgeable-spyware problems, is a rundown of the steps she 
took to correct it.


Faustus



**** RECAP ****
1. Connie reports error message thrown up by Internet Explorer after 
visiting http://www.getptr.com/pages/index.php?refid=northlodge, and 
several other sites. Error message reads: "Internet Explorer cannot 
open this helper application for dtdp://748|331|1|jgen44.cjt.net/..."
2. I tell Connie to run Safe Mode scans with antivirus software, 
CWShredder, and Ad-Aware. This fixes a different spyware issue, but 
not the original "helper application" one.
3. Connie sends me exported .txt copies of her machine's startup 
folders, culled from RegEdit.
4. I take a look at her registry entries and post the message below.
5. Huzzah! Problem solved.
**** /RECAP ****



Hi, Connie,


OK, there are a few suspicious items in your startup folders.


1. Go to Control Panel >> Classic View >> Add/Remove Programs

2. Remove all programs that look anything like: 
"ai roboform"
"consumer input"
"java runtime environment"
"microsoft java virtual machine"
"roboform watcher"
"samcluster"
"siber systems"
"sun java"
"survey alerts manager"


3. Reboot into Safe Mode. Start >> Run >> "regedit"

4. Edit >> Find. Make Sure "Keys", "Values" and "Data" all have ticks 
in them. We're going to search for and delete anything that looks 
like:

"roboformwatcher.exe"

(Specifically, we're looking for data entries - in the right-hand 
pane). If you find a data entry called this, press [Del] to get rid 
of it. If in doubt, you can export the entry as a .REG file, and save 
a copy to the desktop, before deleting. Information exported in .REG 
format can be put back into the registry at any time, by double-
clicking the file.

Some data entries may be duplicated elsewhere in the registry - press 
[F3] to search again. Keep doing so until the whole registry has been 
scanned, and all references deleted.

5. Repeat step 4 for the following data entries:
"consumerinput.exe"
"consumerinputua.exe"
"robotaskbaricon.exe"
"skinkers.exe"

6. If, in your searching, you see folders with the following names, 
you can delete them. (It is safe to do so if the corresponding 
programs were removed earlier through Control Panel, and it is 
definitely advisable if you see any other .EXE files pointing to 
these folders):
"\Consumer Input\"
"\Siber Systems\AI RoboForm\"
"\Survey Alerts Manager\"

7. Close RegEdit. Open Windows Explorer. Navigate to the following 
folders and delete them:
"C:\Program Files\Consumer Input\"
"C:\Program Files\Siber Systems\AI RoboForm\"
"C:\Program Files\Survey Alerts Manager\"

8. Search all the TEMP or TMP folders on your system for oddly-named 
.EXE files, and delete them.

9. Reboot and log in as normal. Open your web browser, go to:
http://java.sun.com/getjava/

Click the "Download Now" button and follow the prompts. This version 
of Java is more secure than Microsoft's.

10. At this stage, if you insist on using Internet Explorer, I would 
recommend installing IE-SPYAD2 and the SpywareGuide.com's block list 
file. Then download and install SpywareBlaster. Instructions can be 
found at the websites.
https://netfiles.uiuc.edu/ehowes/www/resource.htm
http://www.spywareguide.com/blockfile.php
http://javacoolsoftware.com/

It is important to keep all of the above updated - visit the websites 
once a month.

If you are interested in trying another browser (and I would 
certainly recommend it), you can get FireFox from:
http://www.mozilla.org/products/firefox/

11. Reboot, and try your problem website again.

Faustus



--
<Please delete this line and everything below.>

To unsub or change your email settings:
http://www.freelists.org/webpage/pctechtalk

To access our Archives:
http://groups.yahoo.com/group/PCTechTalk/messages/
http://www.freelists.org/archives/pctechtalk/

Other related posts: