View Full Version : Not able to install SpyBot S&D
makaveliliveson
2011-08-06, 20:55
I have some kind of worm or other malware that is redirecting my search engine searches on IE and Firefox to a number of different sites including "free-fast-answers.com." So I am trying to install SpyBot in an effort to resolve this issue since my Norton Security has not found any issues. I get all the way through the install until the last 200kb or so and the I get a program pop-up that says "internal error: Failed to expand shell folder constant "userappdata"." Any help would be appreciated.
Go into safe mode with networking, install Spybot, update, and scan.
makaveliliveson
2011-08-06, 21:17
I tried it in Safe Mode and Safe Mode with Networking and still cannot install.
makaveliliveson
2011-08-06, 21:33
Windows 7 64-bit SP1
Is anything strange running in memory? Open the task manager, hit "Show processes from all users", and look for stuff with random letters (like "wsqweq.exe" or "re8rjae89")
makaveliliveson
2011-08-06, 21:42
atiedxx.exe
csrss.exe
Those are the only two that look strange.
Nah, they're normal.
Run cmd from the command line, and write regedit. Navigate yourself to HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel. Check for the existence of keys named ResetWebSettings or HomePage. If such keys exist, delete them.
Next, navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Verify that the information stored in the Default_Page_URL key and Start Page key is correct. If these keys contain values that reflect an undesirable startup page, double-click on the key to open its dialog box and then replace the existing value with an appropriate one.
makaveliliveson
2011-08-06, 22:08
There isn't an Internet Explorer group in the Microsoft directory tree, so I cannot check the Control Panel for anything. The Home Page is correct, though.
Hello makaveliliveson,
As per this forum's sticky Please don't post Malware logs in the Spybot forum, thanks :-) (http://forums.spybot.info/showthread.php?t=1266) the HJT log has been removed. Also the thread has been closed to avoid confusion about a possible infection and its removal. ;)
I posted to your topic in the malware forum providing a link to the procedure in order for you to receive assistance from a helper. http://forums.spybot.info/showthread.php?p=410488#post410488
Best regards. :)
Edit
http://forums.spybot.info/showthread.php?t=63574