Web Browsers

[pebbles]

CT? JohnD? EG? Anybody??

I've heard (as well as experienced) Comcast toolbar causes problems like hanging up loading of websites, but haven't been able to get rid of it, or Desktop Doctor.  I did try removal through Add/Remove but they're both still in residence.  The Doctor still continues to appear on the A/R list despite attempts to remove it there.   I even went and unchecked Coomcast Toolbar from View/Toolbars, but that only made my Google toolbar go away (even though Google Toolbar is still checked and Comcast Toolbar is not).  If there's a thread on these in the fora I must have missed it and would appreciate directions to it, as I would love to know how to get rid these two annoying critters.  Otherwise, any sage words of advise?

Dell Dimension 8300/IE6.0

[Xoanan]

Hi Pebbles

Do you get any errors or messages of any kind, when you attempt to remove this programs in the A/R?  If so, you might try to remove them in safe mode; a lot of times, if a program is running at the moment or is being used by another application, the A/R will not remove it for that reason. 

Just a thought.

[CajunTek]

What Xoanan said.. Yep.. give that a try..

Message Edited by CajunTek on 07-20-2006 07:48 AM

[pebbles]

No error messages, Xoanan, just no results.  I'll try the safe mode route and see what happens - thanks for the suggestion!

oh, btw, one curious thing I found playing with the View/Toolbar function was that unchecking the Comcast toolbar removed the Google toolbar from view, and vice versa for unchecking the Google toolbar.  Hummm...

[pebbles]

Nope - got the same results in safe mode for Desktop Doctor as in normal mode.  An 'uninstall' option pops up asking if I want to remove the program, I click on yes, and nothing happens except the pop up goes away.

As for the toolbar, although it isn't showing on my screen anymore I know it's still on my system.  Is it fairly safe to do a search and destroy through the 'search' function to get rid of these completely?

Thanks again!

[CajunTek]

I think so.. But.. This thing is a real pain for some to remove.. Proceed with caution..

[EarlyOut]

Before trying a brute-force manual removal, I'd be inclined to try reinstalling it, then trying an Add/Remove from Safe Mode.

[pebbles]

I'll give it a try, EO.  Hope I don't get two Doctors I can't get rid of!

[EarlyOut]

---

pebbles wrote:

I'll give it a try, EO.  Hope I don't get two Doctors I can't get rid of!

---

Just think of it as a second opinion.

"Doctor, I want a second opinion."   "All right. You're ugly!"  [rim-shot]

[pebbles]

Well, the second opinion was pretty ugly - DD setup said I need to uninstall previous version of DD using Control Panel and run setup again.  Guess that leaves me with surgical removal of the toolbar and Doctor bits and pieces... now where did I put that shovel and pickaxe...

::

[Xoanan]

He's right, that might help;

Occasionally, maybe even more often, some programs will place registry entries into the system making it hard to remove.   Reinstalling and then uninstalling may help. 

If you have XP,  system restore "may" help, but its not a guarantee.  In theory, it could remove the registry entries that were placed there by the toolbar(s).  The fact that, that google toolbar and comcast toolbar seem a bit jumbled tells me that one or the other(possibly both) have been corrupted and therefore will probably have some corrupt registry keys as well. 

[CajunTek]

---

pebbles wrote:

Well, the second opinion was pretty ugly - DD setup said I need to uninstall previous version of DD using Control Panel and run setup again.  Guess that leaves me with surgical removal of the toolbar and Doctor bits and pieces... now where did I put that shovel and pickaxe...

::

---

I was concerned about that, and why I left you with the brute force method.. I have seen some have success with the reinstall method so.. I kept my fingers off the keyboard... Oh well no harm.. Good luck with brute force..

[Xoanan]

Yikes!

This may need a HJT log to see what else is going on

[pebbles]

I ran one this morning thinking I'd have HJT fix the registry keys for those two programs, but then I chickened out and decided to post the problem to the forum first.  Here's the log, if ya'll would be so kind as to give it a look-see.  Though there's plenty of Comcast toolbar references, I don't see DD in there.

-------------------------------------------------------------------------------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 8:06:34 AM, on 7/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.microsoft.com/isapi/redir.dll?prd=i...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: SpoofStick BHO - {CBA74CDA-DF78-4AD9-954E-3B15D0A993DE} - C:\Program Files\CoreStreet\SpoofStick\SpoofStickBHO.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - C:\Program Files\CoreStreet\SpoofStick\SpoofStick.dll
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell AIO Printer A960] "C:\Program Files\Dell AIO Printer A960\dlbfbmgr.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124712396359
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[CajunTek]

Ok Pebbles, this might be your uninstall problem.. You appear to have both Ewidos Guard (real time protection) and Windows Defender real time protection.. Now both of these are good things.. They may be blocking these uninstall attempts.. I suggest you turn off these background guards and try the removal process again..

[pebbles]

Would love to say it worked, CT, but unfortunately that didn't make a difference.  What do they make that thing out of, a programming version of Teflon?

[CajunTek]

Pebbles, Have you got the DDoctore disabled in MS-config?

We can remove the toolbar like this..

Close all browser windows, start Hijackthis and select scan only, Place a check by each of these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/

and click on fix..

Reboot, post a new log, and let me know if DDoctor is disabled by msconfig.. It doesn't appear to be running...

[pebbles]

Hey CT!

I looked in run/msconfig services and startup but don't see DD in there.  Is there somewhere else I should be looking?

Completed the HJT steps - here's the new log.

Thanks!!

-------------------------------------------------------------------------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 10:50:18 AM, on 7/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell AIO Printer A960\dlbfbmgr.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Dell AIO Printer A960\dlbfbmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://www.microsoft.com/isapi/redir.dll?prd=i...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: SpoofStick BHO - {CBA74CDA-DF78-4AD9-954E-3B15D0A993DE} - C:\Program Files\CoreStreet\SpoofStick\SpoofStickBHO.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - C:\Program Files\CoreStreet\SpoofStick\SpoofStick.dll
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell AIO Printer A960] "C:\Program Files\Dell AIO Printer A960\dlbfbmgr.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124712396359
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[CajunTek]

Oops I missed one... (too many days of work in a row..)

O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL

Fix that O2 line as welll.. Then you can naviate to c:\Program FIles\Comcast (may be a longer name, probably Comcast Toolbar) and delete the dll file of the same name.. In fact you can delete that whole directory.. 

Well DD doesn't appear to be running.. You should be able to hand delete it with impunity..  It looks like the toolbar is gone too Any more problems?

Message Edited by CajunTek on 07-20-2006 10:10 AM

[pebbles]

Not at the moment, but I'll be sure to let you know when (and you know it's just a matter of when!) I do!

Thanks for your help!!

[Drewby]

---

pebbles wrote:

Not at the moment, but I'll be sure to let you know when (and you know it's just a matter of when!) I do!

Thanks for your help!!

---

WOW!  I would of had a Nervous Break Down by now! Good "Luck"

[pebbles]

You talkin' to me, Drewby?

Hey CT!  Ran the HJT log and deleted that 02 key, now no signs of the toolbar anywhere.  The Doctor still appears on Control Panel A/R but doesn't appear to be using up any space and Search doesn't find any files hiding on the system, so I guess I can live with that.   Guess the Doctor is now 'OUT'.

[EG]

Pebbles, do you have the Spybot S & D program installed on your computer ?

It has a feature under "Tools">>"Uninstall Info", that may help you to get rid of that last remnant in your Add/Remove programs.

[pebbles]

I do have Spybot S&D, EG, but don't see a 'tools' option, only 'file', 'mode', 'language', and 'help'.  I also looked in the program files folder for that program in the c:\ drive and did find a 'tools.dll' there which I didn't feel comfortable opening.  Is that the one?

[EarlyOut]

In Spybot S&D, choose Mode, Advanced Mode.  The "tools" section doesn't show up in the "simple" mode.

[pebbles]

Awesome, EO!  Worked like a charm.  I usually avoid 'advance' settings, so I'd have never found that on my own.  Thanks! 

Message Edited by pebbles on 07-21-2006 11:56 AM

[EG]

I'm Chopped Liver, once again

[Naddie1]

Oh no you are not. You are one great guy.

On the other hand, if you need chopped liver and do not have any....................................

Message Edited by Naddie1 on 07-21-2006 08:30 PM

[EG]

[BlueJay]

---

EG wrote:
I'm Chopped Liver, once again

---

EG, think pate`, it's much more elegant sounding, altho, I do love saute`ed chicken livers.

Thanks for the tip, it gave the means to delete a couple of things from my Add/Remove listing that have been hanging around from an a- backwards removal of mine....

ciao,bj

[EG]

[pebbles]

You would never be chopped liver, EG, you will always be pate'!  The edit on my post was because the last person who advised me was Early Out, and you 'E' guys sometimes mess me up.  My original post said EG, which I changed to EO  - my bad for not acknowledging the both of you for your most wonderful and effective advise.  My most sincere apologies, and begging your forgiveness for the oversight error of this most humble student!!!!

 

[EG]

Hee Hee........ No worries Pebbles !!!

I just like makin' a big WHOOP DE DOO outta' nuthin'

[pebbles]

Whew!

[pebbles]

Just a bit more info on removing Desktop Doctor, in case anyone else comes along searching for how to show it the door...

The majority of the software was gone from my system, but the DD icon kept popping up in my startup tray and I was driving myself nuts trying to figure out how to remove it (didn't want to bother you guys - you'd helped so much already!).  None of the usual methods of removal seemed to work.  Then I recalled Queen Evie mentioning the term 'tgcmd' to another member when I did my original forum search on DD removal (though she was actually providing advise to someone who wanted to ADD Dr. Frankenstein ).  HJT revealed it was in my system, so I looked it up on answersthatwork.com to see what it was.  Shore 'nuff, they recommended removal so I had HJT 'fix' it.  No more DD icon in my startup tray.

pebbles will now go hide behind a rock (Baric's, perhaps) and wait for some more knowledgeable forum member to come along and say 'You Removed WHAT??!!'

[Naddie1]

Good for you, pebbles.

[THerr]

Well I am having the exact same problems removing Desktop Doctor

can uninstall at all and trying to reinstall says I have to uninstall

After reading all the replys ...I am completely lost on what Pebbles did to successfully remover DD...I know alot about computers and am not afraid to try things but I dont know squat about all those files thingies Pebbles ran

[pebbles]

Hi THerr!

There was a lot of back and forth figuring this one out, plus I also wanted to get rid of the Comcast Toolbar so it must seem pretty confusing to someone trying to follow the thread for Desktop Doctor.

1)  I did a search in the forums on Desktop Doctor to see what others had to say about it (if anything) and found a few threads on it.  Nothing I thought I could use there, so I posted a thread asking for help.

2)  I did a system search on Desktop Doctor and deleted everything the search found for that program, but it still didn't remove it from A/R (grrr!).  So,

3) I followed the advise that Elevevator Guy (EG) and Early Out (EO) sent me above about using the Spybot S&D software.  I already had the program on my system, but you'll need to download this free program - I think there's a link to their web site in the CajunTek sticky at the top of the Security forum (the title of it starts with "If You Think You've Been Hijacked....") and then follow EO and EG's instructions above.  But an icon for DD still kept popping up in my startup tray, which ticked me off until I remembered something from step 1) above and 

4)  I ran an Hijack This log to target the 'tgcmd' application I remembered from my forum search and delete ("fixed" it in HJT terms) after confirming it was an unwanted application (the website 'www.answersthatwork.com' is useful for that kind of thing).  This software is also free and CajunTek has a link in that same thread I mentioned in #3 above for downloading it.  If you download and run it,  then cut/paste the resulting log in a new thread, one of the experts here can guide you the rest of the way (you may have other stuff in your system that needs to go away besides the 'tgcmd' application for DD).  That got rid of the remainder of DD in my startup tray that Spybot S&D missed.

Here's to a successful purge of DD, THerr!

[Queen-Evie]

Mary, I removed your post in this thread because you also posted here http://forums.comcast.com/t5/Security-and-Anti-Virus/Cannot-get-rid-of-the-Comcast-anti-virus-at-sta... in the thread you started.

Keeping everything in one place makes it easier for us to help you.