Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Can't get rid of this evergrowing program!

Started by i_hate_dealhelper , Apr 20 2005 11:50 AM

  • Please log in to reply

#1
i_hate_dealhelper
Posted 20 April 2005 - 11:50 AM

i_hate_dealhelper

    New Member

  • Member
  • Pip
  • 2 posts
Hi there

I'd be really grateful if anyone could help me out with this. I have a program showing up in the Windows XP Add/Remove Programs Menu that I cant get rid of.
It's listed as Dealhelper, which I think I remember as nasty malware. However I have no pop-ups or other crap on my system so I'm wondering what the [bleep] a program that Windows thinks is 2,413mb is silently doing on my system. :)

I remember spoting this a while ago and I don't think it was this size then, so it's getting bigger in a worrying fashion... ;) Unfortunately I wasn't quite sure what to do with it then, till I found you guys... ;)

Trying to remove it from this menu brings up a Ghost Uninstaller dialog box saying "Installation log file not found!"

I've looked for anything relating to Dealhelper on the C drive and found nowt, not that I'd know where to look anyway... :tazz:

I run AVG, Spybot S&D and Ad-Aware regularly and don't have any problems with spyware or viruses. PC speed is fine, and I also use Spyware Blaster to try to screen out things too. I look at my PC as a fotress against the nasty hostile Internet, but I think I picked up this before I got my spyware guns and I can't shift it. What next, o knowledgeable ones? How can I get rid of this bloated program? :)

Here's my Hijack this logfile, taken half an hour ago

Logfile of HijackThis v1.99.1
Scan saved at 18:48:05, on 20/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Uninstall.exe
C:\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat

5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23

"EPSON Stylus C44 Series" /O6 "USB001" /M "Stylus C44"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SureCleanProfessional] "C:\PROGRA~1\PANICW~1\SURECL~1\SRCLEAN.EXE"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [Rpus] C:\Documents and Settings\Chris Summerfield\Application Data\ruap.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {200B9822-FDDD-4635-A8A4-066AC69ECF8A} ({200B9822-FDDD-4635-A8A4-066AC69ECF8A}) -

http://gateway.ptssa.net/ws/ws.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://a1540.g.akama...meInstaller.exe
O16 - DPF: {58172624-85DD-4482-9E64-02ADCA637E96} - http://www.kungfuche...ivex/web665.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://v5.windowsupd...b?1094749957389
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -

http://us.games2.yim...ctl_0_0_0_1.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FE} -

http://217.73.66.1/m...791220_MDTC.exe
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program

Files\Common Files\EPSON\EBAPI\SAgent2.exe
  • 0

Advertisements

#2
RKinner
Posted 25 April 2005 - 11:07 AM

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP
O4 - HKCU\..\Run: [Rpus] C:\Documents and Settings\Chris Summerfield\Application Data\ruap.exe

is the only thing I see that doesn't belong.

Check its box and then Fix Checked.

You can try to remove deal helper with RegSeeker:

http://www.hoverdesk.net/freeware.htm

install it and then run it and select Installed Applications. Find Deal helper and select it then right click on it and Delete selected Items.

Ron
  • 0

#3
i_hate_dealhelper
Posted 30 April 2005 - 07:25 AM

i_hate_dealhelper

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Hi Ron

Thanks for the reply, and sorry for the delay in getting back to you. I have removed

O4 - HKCU\..\Run: [Rpus] C:\Documents and Settings\Chris Summerfield\Application Data\ruap.exe

from the Hijack log. Thanks.

I've downloaded and installed Regseeker, and tried to remove Dealhelper. Unfortunately I'm hitting the same problem of a Ghost Uninstaller dialog box saying "Installation log file not found!" coming up when RegSeeker tries to delete it. Aaarrgh! :tazz:

The only thing I can think to do is perhaps try to re-install dealhelper so that I can remove it? What do you think, a silly strategy? Then at least a copy of the [bleep] uninstallation log will be there! Howwever I've no idea where to find it from and I don't think it would just be a matter of getting dealhelper, I'd probably get a whole load of rubbish with it too.

Anyway, thanks for the help. ;) If you can think of any other ways to kill this thing please let me know.

Cheers
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP