Yahoo's install wizard...can't get rid of it!

Hi I am new here.

I have already posted this problem on other forum but I am getting nowhere with it.

This is a really weird problem. If I tried to open Add/Remove in Control Panel, Yahoo's messenger install wizard pops up instead of the usual add/remove programs. And right-click on My Computer will prompt it as well!

I have tried everything, removing every yahoo entry in Registry and even deleted user/internet/windows temp folders yet it still come back! Even tried Ccleaner, regseeker, you name it...

If I went go ahead and installed it, the problem is still there.

Also on Rev Uninstaller, I tried hunter mode and it pointed to a file inside temp folder. I have already deleted it in safe mode and it still come back! It is driving me mad!

I suspect that Add/Remove programs and System Properties have short-cut to a small Yahoo installer file. I don't know how Yahoo does that.

If you've deleted all Yahoo reg entries and files...there's no way it can reappear.

You mention all those "instant registry fixes", but have you tried a manual search of the registy, using regedit...and a manual search of your system, using Start/Search and "yahoo"?

Do you have any Yahoo programs installed?

Have you tried running chkdsk /r to straighten out your file structure?

Louis

Fixed it!!!

I have done a manual registry search and found some remaining yahoo enteries including one linked to run32dll.exe. However, that didn't stop the installer popping up and I had to do registry search again, found the same entry that linked to run32dll.exe in system32 folder. After deleting it, I decided to have a look at this file, it has Yahoo icon on it! So I deleted it and replaced it with one from XP CD.

It worked perfectly now! I couldn't have done it without your suggestion!

Thanks a million!

Gary

wondering why yahoo installer decided to rename itself run32dll.exe and place itself in the system32 folder....

Edited by Michael-Anthony, 03 December 2008 - 03:40 PM.

wondering why yahoo installer decided to rename itself run32dll.exe and place itself in the system32 folder....

I know, weird.

wondering why yahoo installer decided to rename itself run32dll.exe and place itself in the system32 folder....

I know, weird.

of interest, have you run any scans to check for possible infections as A cause?

of interest, have you run any scans to check for possible infections as A cause?

Done that already with spybot, combofix, smitfraudfix and NIS 2009...found one with combofix, I can't remember what it was called though.

But then, it's Yahoo...

Edited by barnettgs, 03 December 2008 - 04:55 PM.

I guess you did not know this about the ComboFix tool ?

ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer.

as you have not yet tried this malware scan , maybe run a scan with malawarebytes to see if it finds anything?


Please download Malwarebytes Anti-Malware and save it to your Desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan.
  
  If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
  
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.


see if that finds any infections?