[Pooky]

Hi

I was wondering if anyone could help me. I am unable to uninstall anything on my computer. The Add/Remove buttons that should be listed beside my programs in the Add/Remove Programs menu are not there anymore. The programs also have no uninstall options in the start menu. Any help or suggestions would be great.

Here is a log file from Hijack This!:

Logfile of HijackThis v1.99.1
Scan saved at 9:45:48 PM, on 2/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YServer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Temp\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY... io&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.h....rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c....ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c..../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c..../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c....ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c..../www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.h....rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c..../www.yahoo.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\Program Files\Panicware\Pop-Up Stopper\dpps2.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\DOCUME~1\COMPAQ~1\Desktop\ISUSPM.exe -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing) (HKCU)
O12 - Plugin for .m4v: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink...xp/CheckDVD.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

I have tried booting in Safe Mode to uninstall programs but there are still no buttons. I let Adaware check my computer for Spyware and it found nothing other than webpage cookies, which I deleted.

Thank you in advance for any help you can provide.

Edited by Pooky, 16 February 2006 - 09:29 AM.

[Advertisements]

Hello Pooky

Let's see if we can find out why your programs don't have a remove option.

Go to Start > Run and paste the following into the box:

regedit /e c:\export.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

Click OK.

It will be too large to copy and paste here so you will need to attach it to your next post.

When you're in the reply box, click "browse" and navigate to c:\export.txt
click Open, then click Add This Attachment.

[Michelle]

Hello Pooky

Let's see if we can find out why your programs don't have a remove option.

Go to Start > Run and paste the following into the box:

regedit /e c:\export.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"

Click OK.

It will be too large to copy and paste here so you will need to attach it to your next post.

When you're in the reply box, click "browse" and navigate to c:\export.txt
click Open, then click Add This Attachment.

[Pooky]

Ok, here it is.

Thank you for helping me! I really appreciate it! My computer has been running really sluggish and I wanted to remove some pre-installed software that came with my computer to try to free up memory.

Then again, if I have a virus or something I guess THAT would be what is slowing down my computer. But none of the virus scan programs I tried could find anything, and neither did the spyware programs.

Again, thanks for your help!

Attached Files

•  export.txt   33.03KB   228 downloads

Edited by Pooky, 19 February 2006 - 01:36 PM.

[Michelle]

What programs are you wanting to remove exactly?

Open HijackThis.
Click on None of the above, just start the program
Click Config (bottom right)
Click Misc Tools
Click Open Uninstall Manager
Click Save List - Save it anywhere.
A notepad will pop-up after it's saved, please copy everything in that Notepad and paste it here.

[Pooky]

OK, the list is below.

Well, in looking at my msconfig startup list, I noticed that two programs are running there at startup that I don't want/need. One is associated with Microsoft Office, which I don't use or need (A trial version was installed on the PC when I got it). The other is associated with Sonic DVD programs which I also don't use.

If it helps at all, the two executables that run at startup that I don't want/need are:

ctfmon.exe (MS Office)
isuspm.exe (Sonic DVD)

Not to mention the fact that I'd like to be able to uninstall programs when I no longer need them.

Thanks for your help!
------


Ad-Aware SE Personal Google Talk (remove only) HijackThis 1.99.1 iPod for Windows 2006-01-10 iTunes Network Play System (Patching) QuickTime Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Spybot - Search & Destroy 1.4 TeLL me More The Sims Viewpoint Manager (Remove Only)

Edited by Pooky, 19 February 2006 - 08:37 PM.

[Michelle]

Also, please do this for me:

Go to Start > Run and paste in the following line:

regedit /e c:\policies.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies"

Click OK.

Using Windows Explorer (right-click your start button and go to "Explore") navigate to c:\policies.txt, it won't be large so you can just copy and paste what it says into your next reply instead of attaching as you did last time.

[Pooky]

OK, here it is. Sorry I attached the previous request as a txt file rather than copy and pasting it like you asked. I fixed it though.
-----


Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000091

[Michelle]

That's fine you could have left it attached, it was easier to read that way

Can I get a screen shot of what your Add/Remove programs look like please:

Just click on Ad-Aware, then please take a screenshot of this window for me.

• You can do this by pressing the PrintScreen key.
• Then go to Start > All Programs > Accessories > Paint
• In Paint, go up to Edit > Paste
• Then Go up to File > Save As. Click the drop-down box to change the "Save As Type" to "JPEG", name it what you want, and save it where you want.
• Then click Add Reply in this topic.
• Click the Browse button.
• Locate the file you just saved, click on it, then click Open.
• Click Add This Attachment.

[Pooky]

OK, I forgot to add that anything I've installed since discovering the problem CAN be uninstalled. So, Ad-aware does have an uninstall option.

I've attached the picture you requested, along with a picture of Microsoft Office highlighted so that you can see the problem I'm having. Hope it helps.

Thanks again!

Attached Thumbnails

• 

Attached Images

• 

[Michelle]

How long ago did you discover the problem? Do you remember installing/uninstalling anything just prior to this?

Let's do this next please:

Please download FileFind from Atribune.
Unzip the file and save it to your desktop.

To run FileFind, please do the following:

• Click on FileFind.exe
• In the box labeled "Directory"
  • C:\
• In the box labeled "File"
  • Enter: appwiz.cpl
• Now click on the "Search" button
• Once the utility has found the files click on "Export"
• A Notepad will open up. Please copy the entire contents of the Notepad and paste them here.
• NOTE: The notepad is saved on your C:\ drive as "Export.txt"

[Pooky]

I discovered it a couple weeks ago. The last thing I remember uninstalling was the HP Boot Optimizer program that was pre-installed on my computer, but that was one of a the few that still had uninstall options. Many others, like games and the two programs I mentioned, had already lost the add/remove options.

Here are the results of the FileFind search.
-------------

C:\WINDOWS\system32\appwiz.cpl - 549888 Bytes
C:\WINDOWS\system32\dllcache\appwiz.cpl - 549888 Bytes

[Michelle]

Hello Pooky

Since recent programs you install have the remove button, then there is nothing we can do to get those buttons back for the other programs. Apparently just prior to your problem something (there is no telling what) caused the loss of the uninstall information in the registry for these programs - without that information in the registry the programs can not be removed through the Add/Remove programs applet. They can still be removed from the system, just not through the Control Panel. There is no way to get the uninstall information back for these programs except if you were to reinstall the programs, then they will have the uninstall option. At this point, the only logical thing we can do is to locate the uninstallers for the programs you wish to remove and remove them from your system that way. If you wish for me to help you locate the uninstallers for the programs you want to remove I would be more than happy to assist.

Also, we can remove those two items you mentioned earlier from startup to free those resources. HiJackThis will do that for us.

Run HiJackThis. Place a check next to the following items and click FIX CHECKED:

O4 - HKLM\..\Run: [ISUSPM Startup] C:\DOCUME~1\COMPAQ~1\Desktop\ISUSPM.exe -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

Close HiJackThis.

Reboot your computer and let me know what you would like to do about those programs.

[Pooky]

I'm not sure I understand what you mean about locating the uninstallers. Do you mean that I can download the actual uninstallers for certain programs from the internet or something? Or are they possibly hidden on my computer somewhere?

I would like to re-install some of these programs to get rid of them, however the newer HP's don't come with recovery CDs, and all the preinstalled programs are located on a recovery partition on my hard drive which, just my luck, I have no access to unless I do a system restore which I didn't want to resort to just yet.

The instructions you gave me to remove ctfmon.exe and isuspm.exe worked, however I'd like to completely remove Microsoft Office Standard Edition 2003, Sonic Express Labler, Sonic RecordNow Audio, Sonic RecordNow Copy, Sonic RecordNow Data, and Sonic Update Manager (if this is at all possible).

I very much appreciate all your help!

Edited by Pooky, 20 February 2006 - 09:14 PM.

[Michelle]

Hello Pooky

The uninstallers for programs are on your computer normally in the folder of the program. We are most likely not going to be able to find the executable for the programs that you want to remove since these were preinstalled. However, if I can get the uninstall commands then we can locate and remove them.

Let me think of the best way to get the uninstall commands and I will post back tomorrow. I may need you to go into the registry for me, but I'll give you complete instructions for it. I will let you know as soon as possible!

[Michelle]

Hello Pooky

I need you to go to Start > run and type regedit click OK. Be careful in here!

Click the + next to HKEY_CLASSES_ROOT to expand it.
Under KEY_CLASSES_ROOT, scroll down until you see a folder on the left side called Installer
Click the + next to Installer to expand it.
Under Installer, click ON a folder called Products
Go up to File > Export.
In the next window that opens, under "Save in" choose desktop.
For the file name put products
Click the drop-down box to change the "Save As Type" to "Text Files [*.txt]"
Leave it as "Selected Branch"
Click Save.
Close the registry (File > Exit).

It's going to be large, so please attach it to you next post as you did previously.
I will go through this and locate the uninstall command for those programs so that we can remove them