Re: "irrrar.exe"?

From: Kelly (kelly_at_mvps.org)
Date: 04/04/05 

Date: Mon, 4 Apr 2005 01:29:46 -0500

Most welcome and glad you have it sorted. Thanks for the feedback. 

-- 
All the Best,
Kelly (MS-MVP)
Troubleshooting Windows XP
http://www.kellys-korner-xp.com
"MG." <moreyag@nospam.frontiernet.net> wrote in message 
news:utx0EhGOFHA.4052@TK2MSFTNGP12.phx.gbl...
> Thanks to everyone for writing back, I do appreciate it. I did have 
> success, but I don't know what did it.
>
> I always run AdAware, Spybot, etc in Safe Mode. Plus, the "hide 
> protected...." button is always unchecked in my sytems and it still didn't 
> show up there. That's what's had me stumped!
> Also, I'm using the latest versions of AdAware, Spybot, Norton, 
> CounterSpy, CWS Shredder, HiJack This and Spyblaster. With two kids in the 
> house, each on their own PC,  spyware and Antivirus scans are part of 
> normal routine maintenance in my house.
> My girl had managed to accumulate some 100+ items of malware.
> I also shut down system restore before booting back into Windows to clean 
> anything else left in the backup files.
>
> I did it all over again this morning, shut down, rebooted 3 or 4 times and 
> it is FINALLY gone. I have no clue what it was, or how it got there, but 
> it is gone for now, anyway. I couldn't even tell you which program rid me 
> of it, but it does seem to be gone.
>
> As an aside, CounterSpy is one heck of a program and found and deleted 
> quite a few items AdAware did not. But, it's not free like AdAware so it 
> may be you get what you pay for?
>
> Thanks once again, I'll be back if there are any more problems.
> Regards to all,
> morey g
>
>
>
> "Kelly" <kelly@mvps.org> wrote in message 
> news:ujPQD$AOFHA.2252@TK2MSFTNGP15.phx.gbl...
>> Hi,
>>
>> Boot into safe mode.  Under Folder Options/View:  Show hidden files and 
>> folders, uncheck Hide protected operating system files.  Then navigate 
>> to: c:\windows\system32\irrrar.exe
>>
>> Right click, delete.  If it doesn't remove, which it should, end the 
>> process first via the task manager, then delete.  It should then be 
>> removed from msconfig/startup and your registry runkeys.  Post back if 
>> you are needing any further help.
>>
>>
>> -- 
>>
>> All the Best,
>> Kelly (MS-MVP)
>>
>> Troubleshooting Windows XP
>> http://www.kellys-korner-xp.com
>>
>>
>> "MG." <moreyag@nospam.frontiernet.net> wrote in message 
>> news:%231Qa5i%23NFHA.3380@TK2MSFTNGP15.phx.gbl...
>>> Hello to all.  I have been laboring for days to get my 18 yr old 
>>> daughter's PC free from the boatload of spyware, crapware and scumware 
>>> she managed to accumulate. I think I'm ALMOST home free, but something 
>>> keeps adding the program "irrrar.exe" to the group of startup processes. 
>>> I ran a multitude of Adware removal programs, and then check the startup 
>>> tab in msconfig, and every so often there sits "irrrar.exe" with a path 
>>> to c:\windows\system32\irrrar.exe
>>> When I look in the directory, it is not there. Yet CounterSpy shows it 
>>> as a running process and terminates it. To answer the obvious, yes I 
>>> have the "show all files button" ticked and all others relating to 
>>> hidden and system files.
>>> Does anyone know anything about this program? I searched Google and 
>>> yahoo and came up empty.
>>> Thanks in advance to any and all for the help and best regards,
>>> morey G
>>>
>>
>>
>
>