Removing an Application (W2K)

[noppojp]

i installed an application in stealh mode. Changed the password to the app. Forgot the password (actually must have typed in the same WRONG thing twice, because i can't get in the app). Want to uninstall, and then reinstall. How can i do that? Thank you very much. This post from Tokyo.

[mysterywolf]

what app was it?

[noppojp]

It was someone elses software, and i truly doubt you'd know it. I was trying it on for size before i buy it. He wouldn't take the time to explain it to me, but let me borry his disk to see if i would find it useful, and then return it to him. It's called Spector 2.12. It's a keylogger (spyware) program. i added a password to keep it from being opened by just any user, just in case they got lucky and hit the right key to get into it.

More info - I've tracked down the program files in c windows system32. There are 5 of them i think - 4 w/same exact file dates. One is very close to dates of teh other 4. It's a DLL. Even if i delete them and reboot, it won't work. Any ideas. i've tried about 100 times to get the password right, but it just ain't working.

[noppojp]

The problem is deeper. i've tried every possible password i can. It just doesn't like what i typed. I spent about 5 hours on the password, trying to get it right, but NO GO.

i've found that there's a slew of files that were installed when it was put on by the setup facility. i've found the files, but it won't let me remove them because it says they're in use.

Anyway i can get rid of this thing. i don't want it on my system anymore. Any help would be appreciated.

Cheers from Tokyo.

[noppojp]

i've SINCE THE LAST POST started up in safe mode, and deleted all (95% confidence) the files that were installed by the setup facility when i installed the package. NOW my problem is that it still shows the icon down in the System Tray. HOW can i get rid of these? Thank you for your help.

[noppojp]

I think the problem is bigger than just deleting files. The icons still show up in the system tray. i've copied a LOT of text from this site about removing things from the system tray. i'll pick and choose what to apply today.

SO - i have a new question for the gurus out there in cyberspace on this site:

How can i remove ALL RESIDUAL ANYTHING about an application - something tells me it's got something to do with the Registry, but i'm not sure? For instance, when i went to reinstall the app, the same Registration info (Installation key ya can call it i suppose) was already in the appropriate field during installation. i've looked in the Registry and can't make heads or tails of what the app is called in there. Is it the Registry that keeps all installation info like product registration keys, etc?

ANY IDEAS FOR WHAT I CAN DO TO KILL ANY/ALL RESIDUAL CLINGONS IN MY OS in terms of this software???

i would really appreciate some help on this.

....in the mean time, i'm gonna go through all this text about the system tray hoping to find something...)

From Tokyo

[Andy-S]

There is a utility called inctrl5 that will monitor an installation and log all the registry keys and files that were written. Download it from here <a target="_blank" href=http://www.pcmag.com/article2/0,4149,73039,00.asp>http://www.pcmag.com/article2/0,4149,73039,00.asp</a> and re-install your application. That way you will see exactly what is installed and you can remove it.

Cheers
Andy

[Jama]

Most start up applications are run from the Run keys in the registry but I suspect that yours is not. Spyware apps like to run in stealth mode (hidden from the Task Manager) and for that they install themselves as a service rather than a start up command.

I’ve written a vbscript for exactly this kind of situation. You can find it <a target="_blank" href=http://www.angelfire.com/ia3/jama/Startup_Applications.Vbs>here (you might need to right-click the link and select Save As)</a>
When you run the script, it’ll give you a detailed report of all services installed including the ones that are not running along with running process, start up application and their start up location.

You should be able to establish weather it’s a service or an application you are dealing with.
If it’s an application, then find the regkey that starts it and delete it. (use this key to find the executable first, then delete the .exe as well as the regkry).

If it’s a service, then you have 2 options;
1- Click start – run - Services.msc, find the service in question and disable it. (This is the safer option of the 2)

2- click start – run – cmd. Type;
sc delete ServiceName
this will delete the service from your computer.

When manually “uninstalling” applications, it’s recommend that you don’t delete any file unless you are certain that it’s not needed by any other application or by the OS itself.


Jama