The Mudcat Café TM
Thread #102133   Message #2067826
Posted By: JohnInKansas
03-Jun-07 - 11:48 PM
Thread Name: Tech: Comp Virus Crush 'Em 2.0
Subject: RE: Tech: Comp Virus Crush 'Em 2.0
Any attempt to search for "Crush 'EM" in Google gets swamped with hits on a rap piece that's apparently be "covered" by 43% of all rap performers worldwide.

NONE of the links where "removal" is at issue seem to be able to provide any information about what these programs are, or where they might come from, although there are vague clues that might tie them to some drivers for an obsolete Packard-Bell scanner.

Some vague information seems to indicate that they're related to a "screen saver" function, that may have been "bundled" with a driver download.

Microsoft information suggests that the failure of Safe Mode startup might be related to scanner or video driver corruption, or use of an inappropriate driver for either. Installation of WinXP SP2 can corrupt either kind of driver, which will then cause the Safe Mode failure to boot. This corruption occurs only if the driver was incompatible prior to the SP2 installation. The procedure given is to boot normally, remove the driver, uninstall SP2, and then reinstall SP2. With the driver NOT PRESENT you'll get a valid installation of SP2. (You will also need many Megabytes of additional critical patches issued subsequent to SP2.) You can then, if necessary, install a compatible driver that you may be able to get from your video card maker.

As there is NO INDICATION that the files/programs in question are "viral," there is no compelling reason why they absolutely have to be removed, unless there is a specific performance problem that can be cited. Knowing what problem(s) the files are causing could be quite helpful in suggesting what needs to be done for removal.

The main reason why Windows Add/Remove Programs may not be able to remove a program is that a file that is open and running cannot be deleted.

The normal procedure for programs that start something during startup is to boot to Safe Mode, where the Startup folder contents aren't run. Add/Remove Programs usually can then do a complete removal.

One of the sites I found cited an error message stating that the "log-file could not be read by Add/Remove Programs." A couple of posts indicated the presence of "unwise.exe" files. This filename has been commonly used by an install/remove file sytem that's fairly common in junkware, and occasionally crops up in legitimate programs. Sometimes double-clicking the "unwise.exe" file in the folder for a junk program will remove the program, since (maybe) it can read its own install log. This file can also have the same problem with "running files" that Add/Remove Programs runs into.

IF THE COMPUTER CAN BE REBOOTED NORMALLY, you can look for what turns on the program during reboot. If you change things so that the program no longer starts during bootup, you can reboot normally, and Add/Remove Programs, or the associated "unwise.exe," may be able to remove the program.

The most common method of starting something during boot is to place a shortcut to the executable for the program in the Startup folder. If you delete the shortcut, rename it in a way that prevents it from running, or move it out of the Startup folder, the program should not run after your next reboot, and you can attempt to remove the program while running in normal Windows mode.

It probably is safe for you to look in the Startup folder, and see if you can identify something that might be starting the programs in question. You will need to turn on "View Hidden and System Folders" in Windows Explorer, and may need to look under multiple user names:

C:\Documents and Settings\<username>\Start Menu\Programs\Startup

Something of this kind is most likely to be under the "All Users" username, but may be in more than one place.

Processes can also be started during boot by an entry in the Registry, so it may be necessary to find the Registry entry that's causing the program to start, and edit or remove the Key. The next reboot would then not start the program, and removal of the program may be possible in normal Windows mode.

Since you do not know what Registry entry may require change, or where it is, "merely competent" help is not necessarily sufficient. You need CAPABLE assistance from someone who knows how to work safely within the Registry, if you need to proceed to this point.

The inability to boot in Safe Mode indicates a fundamental problem that needs to be corrected, and if you can't get a normal boot to Windows you'll have to fix it first. You probably would benefit from letting your local support genius make the attempts to fix this.

John