Newbie

[Sooky]

Hi all. I have two problems and don't know if I'm in the right area but here goes.I am trying to uninstall AVG9. Ive tried add/remove, it takes me to the uninstall page and it starts to do it but then I get the message that access is denied and there is an error in registry. I'm the Administrator/owner and no one else uses this PC.How in simple terms can I fix this.
The other thing is that something is trying to change my search engine and a pop up tells me this every time I login to hotmail.This pop up is saying it has blocked the attempt.What or who wld be doing that blocking.

Simple terms please guys I'm 65 yrs old I can fix most things but it takes me ages reading help files Terminology is the problem.I don't know it.

[Ritesh_4]

Before uninstalling AVG, make sure to close the application if it is running, and do so from the taskbar, by right-clicking on the avg icon and selecting exit. Then perform the uninstall.
If still not able to remove, then I would suggest to proceed as follows:
1. Download and install unlocker tool

2. Exit AVG from taskbar then go to your Program Files/AVG folder, and delete folder from there
or
You can also right click on the avg folder itself, then select Unlocker, and in the popup window, select Delete from the drop-down list

3. If any file is being in used etc, unlocker will popup a window, asking whether to kill that file etc, kill the files and continue with deletion

[gerbil]

Then there is this tool from AVG... http://www.avg.com/ww-en/download-tools
The changer popup? How about telling us what it actually says, and what originated it, what pgm it is from..? Every hotmail login...heh... prob M$ trying to change you over to Bing.
Bing. How did they come up with that name? How on Earth? What were they drinking?

[Sooky]

Hi lordt and Gerbil, Sorry to be so long answering but Im in Australia time difference comes into play there. Lordt When I right click on the avg icon in the task bar there is no exit option at all,I cannot even stop it running.When I go to ad/remove it will take me through the entire uninstall process to a certain stage and then I get the message access denied etc and this error code 0x80004005.I have done everything you say and still am unable to remove this program. As for the unlocker well I'm still working on that but don't hold out much hope as it appears that my computer simply does not recognise me as the administrator. Gerbil, what pops up really its not only hotmail even getting to this page it popped the message is up for an extremely short time but I have managed to get most of the message. An attempt to change your search engine has been blocked and thats it it's gone.Interesting side bar, through another program I was using I was directed to another page called Zwankysearch142, I allowed it before realising I didnt have a clue about this thing.So did some reasearch and found that it was/is a browser modifier I have removed it but as it keeps changing its name by using the numbers there are several versions of it.Zwangisearch 147 146 etc is just another variation on a theme.It comes in via the back door and targets as far as I can work out the 32dll whatever that is.Note the different spelling of the name.Microsoft Security Essentials is the only program that will pick this up on my PC so far.I uninstalled MSE last night but am going to reinstall it today. I Do appreciate what you have done both of you to help me, Wonderful site you have here.I may yet have to call in a tech to fix it.

[Sooky]

Yes I think so remains to be seen as it is quite complex involving two separate things The worst of which I think is that my PC does not recognise me as Admin and the fact I have a feeling a that another program is trying to take over my search programs. Thank you so much for your help I most likely will be back.

[gerbil]

Mmm... then I am very likely south of you. Could you do these two things?
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Copy and post that log [it is also saved under Logs tab in MBAM].
{If it will not run in Normal mode try a Safe mode run first, then repeat in Normal mode.. save and present both logs].

==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe
-CLOSE ALL OTHER APPLICATIONS and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.
If you do those thnigs it gives us a base to work from. It does sound as if the browser change warning is coming from the malware. So lets have a go at cleaning that out. Once we can see it.. well, most things can be removed easily enough.

[Sooky]

Thank you Gerbil, I already have malawarebtyes on here will do as you say after printing it all out.I'm on the Sunshine Coast Mooloolaba BTW.

[Sooky]

Hi Gerbil Iam sorry but I am having a problem here in that I am not that good on doing some things.first of all I have created the imabunny file, I have downloaded the hijackthis scan program but the name as changed.I am going to insert the link to the results of that scan.well I would if I knew how to. It seems the further I go the more confused I get. I also cannot find the exe you mentioned,I'm going to log out of here and give it a rest for a while and attack the problem again tomorrow. Thanks again cheers helen.

[Sooky]

Download Trend_Mic...html (66.5 KB)
Trend_Mic...html
[Download Trend_Mic...html (66.5 KB)] Download(66.5 KB) Hi gerbil. I dont know if this will help.Its an email I sent to myself after sending it to another email account.
I use hotmail and yahoo.

[Sooky]

BTW Gerbil malawarebytes did not find any bugs at all.

[gerbil]

Oops. Sorry, Helen, I forgot that the hijackthis download from the site I gave now comes as an installer package which actually installs Hijackthis as a program. It is also still available as an executable [exe file] which does not require installation.
I have accordingly reworded that advice script [meant to do it ages back...]. Note that I have removed the renaming; that was a hangover from when malwares identified hijackthis and prevented it from running.

HiJackThis:
You have a choice of versions, installable program or stand-alone executable; in action they are fundamentally identical.

i] -download hijackthis: http://www.majorgeeks.com/download5554.html or http://www.filehippo.com/download_hijackthis/
-dclick that .msi file to install Hijackthis as a program. Else...
ii] - download the executable file from: http://www.bleepingcomputer.com/files/hijackthis.php
- unzip if necessary; copy hijackthis.exe to a new FOLDER placed either alongside your program files or on your desktop.
Start Hijackthis via the desktop icon or by dclicking hijackthis.exe.
- CLOSE ALL OTHER APPLICATIONS and any open windows including the explorer window containing HijackThis.
- click the Scan and Save a Logfile button. Post the log here. It is fine to just add it as text to your post, or you can attach it via the Advanced Editor section.
MBAM should have identified and removed Zwankysearch [zwangisearch] if it was present. But we can check that. They are browser redirectors, sending you via their own website, and include their ads.

[Sooky]

Hi gerbil, thanks for this I have done the scan and the analyse this and saved them.Is it possible to send these to you in an email to your site? cheers Helen

[Sooky]

Trend Micro HijackThis v2.0.4 * Hi Gerbil is this what you need?

[Sooky]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:57:02 PM, on 6/11/2010                 
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal        HI Gerbil this is what I got when I clicked analyse this.
                         Hope it helps you. Cheers Helen
Running processes:       
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Glary Utilities\memdefrag.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\My Download Files\imabunny\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\PROGRA~1\IMESHA~1\MediaBar\ToolBar\iMeshMediaBarDx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZon1.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O3 - Toolbar: MP3 Rocket Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\PROGRA~1\IMESHA~1\MediaBar\ToolBar\iMeshMediaBarDx.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [Glary Memory Optimizer] "C:\Program Files\Glary Utilities\memdefrag.exe" /autostart
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: [url]http://www.mp3rocketpro.com[/url]
O15 - Trusted Zone: *.mymusicinc.com
O15 - Trusted Zone: [url]http://www.news.com.au[/url]
O15 - Trusted Zone: [url]http://www.superantispyware.com[/url]
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - [url]https://support.microsoft.com/OAS/ActiveX/MSDcode.cab[/url]
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Yahtzee/Images/stg_drm.ocx
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - [url]http://inst.c-wss.com/n035p/EN/install/gtdownlr.cab[/url]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - [url]http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1282613387468[/url]
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - [url]http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab[/url]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [url]http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226448648234[/url]
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - [url]http://cid-fc7916227adb28a7.spaces.live.com/PhotoUpload/MsnPUpld.cab[/url]
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - [url]http://www.gamehouse.com/realarcade-webgames/zylom/zylomplayer.cab[/url]
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Yahtzee/Images/armhelper.ocx
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - [url]http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx[/url]
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - [url]http://antwrp.gsfc.nasa.gov/apod/image/0612/auroraiowa_richard.jpg[/url]

[gerbil]

Cool, Helen. Your last post has the log that I wished to see [x2.. :) ].
Zwankysearch is no more.
Are you still hoping to uninstall AVG9? Choose the uninstaller/removal tool from here: http://www.avg.com/ww-en/download-tools To stop AVG9 dclick on the Resident Shield icon, then uncheck the Residential Shield Settings and lastly click Save Settings. Then run the removal tool.
I'm not sure you need all those toolbars? You can uninstall the ones you don't want. IMesh... hmmm. And
Your trusted zone should not contain any entries, really. Anything in there can download anything it wants, no checks. You can remove them via the Security Zone in IE, else...
-start hijackthis again, click Scan, in the window that opens place checkmarks against all the entries listed below that still exist, and then press Fix Checked.
O15 - Trusted Zone: http://www.mp3rocketpro.com
O15 - Trusted Zone: *.mymusicinc.com
O15 - Trusted Zone: http://www.news.com.au
O15 - Trusted Zone: http://www.superantispyware.com
There is nothing else showing as bad in the log.

[Sooky]

Thank you Gebil, one last request if you don't mind,My computer still does not recognise me as the administrator will doing all this restore it or do I have to create another user account perhaps using the guest account, LOL been doing a bit of hunting around for solutions on that one.I think that one problem is that when I look at system the name is H.Ross s owner, then somewhere else it says Helens puter and a third one is just plain Helen. I have never touched anything in that file only my tech guy has. I do thank you from the bottom of my heart for all your help gerbil.

[Sooky]

Hi Gerbil, I have done everything you suggested, downloaded and ran scans etc but still no joy. is is possible that this message Error: Action failed for registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: creating registry key....
Access is denied.
is causing the problem? for whatever reason I am not being recognised as the administrator. This may be due to the above post where I gave details of the names that appear eg Helen, Helens puter and H.Ross all of these names appear when I open the file.Would this be the problem? If you would so kind enough as to send me precise instructions on how to change the admin to the guest account with a completely different name. Sorry to do this to you but as nothing else is working it is a last resort before I am forced to bring in a tech at God only knows what price.Not a lot left over each fortnight on an aged pension LOL.If you ever come this way send me an email and I will cook you a lovely home cooked meal,

[gerbil]

Firstly, your being an administratror. All too often an account will get blitzed and its properties confused. Often the creation of another account [it must be with a different name because Windows encodes account names and buries those codes deeply] and then the copying across of everything under Documents and Settings will solve that problem. But you cannot use the Guest account to create an administrator account, you can only do that with another administrator account, or through the Administrator account.
Seems like you are the only administrator. Okay. When you installed XP it created the default Administrator account, and it is still there, just normally hidden. It was hidden the moment you created your own administrator account. To reveal it during login you can use Safe Mode, and also there create your new administrator account. [If you are the only user then pressing Ctrl-Alt-Del twice just as windows starts in Normal Mode may not get you the screen with Administrator login]. Oh, by default, the Administrator account password is blank, ie press Enter.
You should also be able to do it while logged in normally if your sys still sees you as an administrator. Let's see if it does... go Start, Run, and enter cmd
In the cmd window enter..
net user -you see there all the accounts your machine has; some may surprise you by their existence! Okay, now enter..
net user helen [or whatever your admin account name is]. Near the bottom is Local Group Memberships; you want it to be *Administrators. But anyway, it appears to be corrupt, so....
To create a new administrator account you first create a new user, then enter that account into the administrator's group. So, enter these two commands..
net user sooky /add
net localgroup administrators sooky /add
-and now sooky is an administrator! To get sooky to show either logoff/logon or restart; the new sooky account is created at that moment. Copy over docs and setts files, folders from helen. Delete helen. Give sooky a password..
net user helen * .

[gerbil]

Another Oops! moment...
Give sooky a password..
net user sooky * .

Oh, computer names. Yes, there are several, and it can be confusing. If you go to System Properties via Control Panel,
[or go Start > Run, paste: control sysdm.cpl,,0 ..and press Enter] you will see under Registered to: your? name and organisation name you gave during installation. The number code is the Product ID and relates to your machine and the installation medium type.
You can only change the first two via registry [see below]. Do not change the Product ID.
A couple of tabs to the left you see Computer Name; this is the name by which your computer would be seen if you networked it. You can change that right there.
To change your registered name and organisation name:
...first copy the text in the box to a notepad [format/wordwrap unchecked], alter what is inside the RHS "" to whatever you desire and let the "" remain, and save as fixkey.reg to your desktop; dclick it to run... agree; if it opens in notepad instead rclick the icon [file], choose Merge, else choose Open with, Registry editor....

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
"RegisteredOrganization"="at home"
"RegisteredOwner"="sooky"

That should do it.

[Ritesh_4]

Hi guys, seems gerbil provided a good support throughout ;)
I came across this help concerning admin accounts in XP, you could give it a try:
http://www.mydigitallife.info/2006/05/07/unhide-the-administrator-account-in-windows-xp/

Also, if still not abled to remove avg, there is a tool called Windows Installer Clean Up which can help hopefully, as I once used it to remove some adobe products which were not being uninstalled properly from my system. Install it and see if you get avg in the list, and click on it from the list and click on remove button to try uninstall

I would also recommend to download a tool like CCleaner or TuneUp Utilities, and scan + clean up the registry just in case...

[Ritesh_4]

Also found a link for avg remover: http://www.avg.com/filedir/util/support/avgremover_en.exe

could be same as gerbil provided or a different one, never harms to give it a try if still having probs with avg :)

Another link to tackle admin problems: http://kb.iu.edu/data/arnd.html

[Sooky]

hi Lordt thanks for that but have tried it didn't work.I have been going around in circles and have decided that as support for xp sp3 ends soon I am going to have to put up with it until I can save up the money to get Windows 7 and pay a tech to install it for me.I did The registry check but I may not have done it correctly so I will try that again tonight or in the morning when I am fresh.I do appreciate the wonderful assistance provided by you all.I simply do not know enough to work with what I'm being told even though I do whatever it is to the letter I print out all these messages.The other thing is with the administrator and not being recognised. I think information overload has kicked in with my brain.Thanks again Cheers Helen. I'll leave this open till tomorrow afternoon then close it.

[Ritesh_4]

Concerning the administrator account, I would suggest you to try create a new account from Control Panel -> User Accounts, and set the privileges to Computer administrator. Save that account and restart the pc, and when starts up, the new account should appear in the welcome screen. Login using that account and try do the steps you have been doing so far to see what you get when you try uninstall avg... also just in case, try to uninstall another program and see if it does so successfully, a program which you are not using currently that is.
Else try to start up in safe mode, and from there try uninstallation process. To enter safe mode, press and hold F8 key when powering on the computer. You will then get a black screen with a list to choose from, like Safe mode, Safe mode with networking, and many more options, just use arrow keys to highlight either Safe Mode or Safe Mode with networking, and press Enter to load. To exit safe mode afterwards, a restart is needed, and do not press F8 key afterwards
Follow this guide for safe mode: http://www.computerhope.com/issues/chsafe.htm

[Sooky]

Hi Lordt. I will give it a go in the morning I need to rest (I have a dicky ticker)Thanks again cheers Helen.

[Sooky]

Thank you all for you outstanding help. Much appreciated.

[gerbil]

mmm.. helen, before you scoot off.... did either of those two procedures I gave you work to create a new administrator account? And if so, were you able to successfully transfer across files that you wanted?
AVG. Gone?
I really do not mind helping further, if I am at all...

[Sooky]

Hi Gerbil, As I said to lordt I think I have got information overlaod and rather than take up time that you could be helping someone else is being selfish because some how some where along the line I must be doing something wrong so I am going back to the beginning and start all over again.I have printed out everything and have kept it.It's frustrating for me as I know I am not a stupid person and usually can fix most stuff.I think I need to slow down and think it out before each step.Something will pop out and I will think AHA I didn't do THAT.I wont do the hijack thing again.What the message says each time I try to remove avg iys stuck in my head what registry key is missing and where it says windows creating registry key but never seems to do it.So if I may I will contact you again. Thanks Cheers Helen.

[Sooky]

ummm Gerbil can you tell me why I am getting what is an add for an escort service in the USA LOL and another for bikes.

[gerbil]

Sometimes, helen, the only way to uninstall a corrupt product is to first correct the installation, then uninstall it. May i suggest that you reinstall AVG over the current pgm? AVG's installer will inspect what you have then ask whether it should repair or uninstall - choose Repair. Then try the uninstallation process again.
AVG installer link [I assume that you have the latest version, free edition? : http://free.avg.com/au-en/homepage
There are free uninstallation programs out there, but i think they all invoke the object pgm's own uninstaller and then search for and delete remnants. I would attempt to repair the AVG first as noted above. If it fails again, well, here are a couple to try: http://www.softpedia.com/get/Tweak/Uninstallers/Revo-Uninstaller-Pro.shtml [30 day free full-working trial] and: http://download.cnet.com/IObit-Uninstaller/3000-2096_4-75161625.html?part=dl-6271865&subj=dl&tag=button [always free].
Not having had any really obstinate pgms I personally have not used either. So....
Ads for escorts [we won't mention ad-targeting here...] and bikes? Time to take MBAM for a trot again [update it first!].
My time. I'm not over-extended. I do this when I have a spare moment, others do crossword puzzles. When I cannot cope, or don't know, i'll say so.
Cheers.

[Sooky]

Hi Gerbil sorry to be so long answering this post was busy helping someone on my computer, now there's a laugh for you. I have Microsoft Security Essentials on my computer which is why I wished to remove avg as it picks up more that what avg does.However to download the latest version of avg 9 free I must stop MSE and so far have not found a way to do that. I uninstalled MSE so as to enable the removal of avg but to no avail.i will sometime this afternoon hit the Microsoft site and try and find out more on how to pause or stop MSE for the time it takes to do the download of avg and trying to remove it. Cheers Helen.