Member Avatar for flyerorange

I run Windows 98. Yesterday, I cleaned out a bunch of suspicious files, on Norton Internet Security 2004 recommendation. The Updater file was one of them. I deleted all the updater and wupdater files. It was suggested that I eliminate all entries of the same file in the registry, as well. I went to the registry, went to Local Machine, and went to Software, where I found Updater. I deleted it. I cannot find any more Updater files, so I think I got them all. I also deleted Incrfind from the same area, because it was one of the files Norton called my attention to.

Is it OK that I deleted the ones from the registry? My internet seems to be fine, but when I shut down, I get a fatal error message, hit any key, and then it shuts down. This message is only since I deleted both Updater and Incrfind from the software portion of the local registry. I'm not sure it has anything to do with it, but now I'm nervous I shouldn't have messed with the registry. Am I Ok on this? :o I'd appreciate any help.

  • 2 Contributors
  • 3 Replies
  • 89 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Deleting suspicious files and registry keys can remove adware, but removing entries under HKLM\Software without a backup can also break legitimate components. The shutdown "fatal error" that started after the deletions is consistent with Windows or an installed program attempting to call a now-missing key or component. reported the error began immediately after removing the Updater and Incrfind entries; that timing is important when deciding recovery steps.

Windows 98 includes automatic registry backups that are designed for this situation. Boot the machine into MS-DOS mode (the Windows 98 shutdown menu offers that option) and run:
scanreg /restore
The utility will present a list of saved registry snapshots; choose one dated before the edits and allow the restore to complete, then reboot. This often resolves fatal errors caused by missing registry entries.

If no usable restore is available, test whether Safe Mode (F8) shuts down cleanly. If Safe Mode is stable, inspect the startup locations for lingering references: the Start Menu "Startup" folder, WIN.INI and SYSTEM.INI, AUTOEXEC.BAT and CONFIG.SYS, and the Run keys in the registry (HKLM and HKCU under Software\Microsoft\Windows\CurrentVersion\Run). A repair or reinstall of the security product (if it was removing or depending on those entries) can restore legitimate updater components and their registry entries.

As suggested, follow up with a thorough anti-malware sweep and a startup/logging utility to look for remaining traces. For future edits, always export affected registry keys first (Regedit -> File -> Export) or create a manual registry backup, and keep a rescue floppy/CD. If the restore attempts fail or if the error message identifies a specific driver or DLL, a Windows repair install or professional help may be the safest next step.

Recommended Answers

All 3 Replies

Member Avatar for crunchie

Hopefully you backed up the registry before messing with it?? The entries you deleted certainly sound like malware entries. Try the following:

Download & instal Adaware from
& update it B4 scanning.
In settings under 'scanning,' have it set to
'scan within archives,'
'scan active processes,'
'scan registry,'
'deepscan registry'
'scan my IE Favourites for banned URL's,'
'scan my host's file.'
In 'tweaks' under 'scanning engine' set it to 'unload recognised processes during scanning.'
Also in 'tweaks' under 'cleaning engine' set it to 'Automatically try to unregister objects prior to deletion' & 'let Windows remove files in use at next reboot.'
Select 'activate in-depth scan' before starting scan.
When the scan is finished select 'next.'
Remove what it finds by placing a check in the box to the left of the object. Reboot

Download & instal Spybot S&D from Update it B4 scanning. Go into settings & have it check for Beta releases also & download if available.
After the scan is complete, have spybot fix everything marked RED.
On the page that first opens when you start Spybot there is an option to immunise, you should do this. In the immunise section there is also a link to download Spywareblaster. This program will prevent the install of bad activex controls that it has knowledge of. Download that & you can keep it updated by selecting the same link that you use to download it. Reboot

I am moving this to the security forum as it is most likely a spyware related issue.

Member Avatar for flyerorange

Thank you for your advice. Do you think it was Ok that I got rid of the Updater from the registry? I was under the impression that it was adware, or malware.

I must say, I do Symantec NIS every year, and am happy with it's virus protection. This year, though, I've had more problems with my computer since installing the NIS 2004. The install is up to date, and the program works, but I still have starting and shut down problems. I didn't think removing the Updater would affect anything about shutdown.

Member Avatar for crunchie

Perhaps you have other problems there that those two programs could not fix. I dumped Norton for EZtrust AV & Sygate firewall. Norton was ok but had to reinstall a couple of times due to corrupted update downloads. Got tired of it. When running NIS with the parental control activated I noticed it used around 70Mb of RAM whilst browsing!!

Download HijackThis from & unzip it into it's own, permanent folder, (Not a temporary folder or the desktop & not directly on your hard drive).
If you have anything disabled in MsConfig, please re-enable it/them.
Start HJT & with all browser windows closed, press the scan button. When the scan is finished the scan button will change to save. Save the log to a text file, copy the entire contents of the text file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is necessary for the running of your system.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.