[Resolved] Cannot uninstall "You Don't Know Jack" Volume 2 {copied missing unwise.exe, repeated uninstall - OK}

[web_girrly]

Apparently I do not know jack.

But someone here does. And I would like your advice.

 BEARDIAG ISSUES - brief summary: (Extracted on 2010/07/01 14:22:08)  
 

 Network configuration is not set for Static IP address. DHCP Server is 192.168.2.1
 System event log has 15 entries for TCPIP 4226 warnings (0.64%). Check for multiple programs or computers possibly overloading the Internet connection and software settings.
 Warning: Possible disk errors present. See How to check your disk drive for errors - do not skip this step.
 Apple QuickTime taskbar player found - resource waster - not necessary. Use the inbuilt Microsoft program MSCONFIG to disable from the startup list
 Sun Java update scheduler found - does not need to be running constantly. Use the inbuilt Microsoft program MSCONFIG to disable from the startup list
 Java update scheduler version 2.0.2.1 was found running. Choice to check for updates was YES
 BearShare currently shows port 6348 for TCP and port 6348 for UDP that need to match with your firewall/router configuration
 BearShare setup is configured for 'Automatically remove completed downloads' setting = 'YES' - this can cause errors.
 You are behind a NAT firewall and/or router. They need to be correctly configured to allow BearShare to access the Internet.
  This is a common cause of problems with BearShare - it can't communicate.
  Check your firewall allows BearShare to communicate on TCP port 6348 and UDP port 6348
  If your connection is via a router, make sure it can forward BearShare traffic to a static IP address on your computer
  Refer to the following guidelines to correctly configure your firewall and router for use:
  - http://cbiweb.com/demo-sites/bearsha...alls/index.htm - the Firewall FAQ at the old archived official BearShare Help site,  
  - www.portforward.com/english/applications/port_forwarding/BearS/BearSindex.htm - the definitive guide to port forwarding and setting up a static IP address.
    (Hint: use static IP address 192.168.2.4, TCP Port 6348, and UDP port 6348).
 Network configuration is not set for Static IP address. DHCP Server is 192.168.2.1
 

 More technical diagnostic troubleshooting information follows:

 BEARDIAG: Bearcare for BearShare.
 Details collected on 2010/07/01 14:15:11, BEARDIAG Version 01.99.26.0 beta, expires 2010/12/11 (163 days), running from C:\Documents and Settings\Rehab\Desktop\Programs\BearDiagNew.exe
 

 System Hardware Information
 CPU Type is: AMD Athlon(tm) XP 2600+, CPU speed is approx: 2131Mhz, System BIOS date is: 2003/01/24, CPUid is: 0383FBFF00000681
 OS Version is: Microsoft Windows XP Home Edition Service Pack 3, OS Build: 2600, 32 bit, Computer Name: WITSEND
 Browser name: C:\Program Files\Internet Explorer\IEXPLORE.EXE, version: 7.0.6000.17055, Admin user? YES, Locale: 0409-English
 

 System Memory Parameters:     Memory in use:     61%
 Total Physical RAM:     1023.5Mb    Available Physical RAM:     394.9Mb
 Total Pagefile:           1.7Gb    Available Pagefile:         1.3Gb
 

 Internet IP Address 184.78.xxx.xxx  Local IP Address 192.xxx.x.x  Another device at IP: 192.xxx.x.x  You are behind a NAT firewall and/or router.
 

 TCPIP: 15 entries for TCPIP concurrent half-open connection '4226' conflict warnings found in system event log, (0.64% of total 2349 entries), latest recorded on 2010/06/16
 

 File Locations
 Program files are at: C:\Program Files, System Temporary files are at: C:\DOCUME~1\Rehab\LOCALS~1\Temp, Common desktop is at: C:\Documents and Settings\All Users\Desktop
 BearShare version installed is: 5.1.0.25, Gnutella servent BearShare full path is: C:\Program Files\BearShare Test\
 Temporary downloads at: C:\Program Files\BearShare Test\Temp\, Completed downloads at: C:\My Downloads\
 

 Disk statistics
 Drive C:    Total space: 31.59Gb    Free: 12.43Gb    Full: 60.6%    Vol type: NTFS    Drive No: 2493995625
 

 Folder Statistics
 Temporary downloads folder:  Space used: 69.7Mb,     File count: 85,     Write access allowed? YES,  # of DAT files: 16, #BAK: 12, #TIGER: 2, #TMP: 42, Other: 13
 Completed downloads folder:  Space used: 4.0Kb,     File count: 3,     Write access allowed? YES
 BearShare library file 'library.db' size is 2.4Mb, '/db' library folder size is 37.6Mb, console log size is 1.1Kb
 

 FreePeers.ini settings
 The freepeers.ini file is found at C:\Program Files\BearShare Test\FreePeers.ini. The extracted settings are as follows:
 

 ProductLogic
 No    : bAlwaysUpdate; Always Download and announce latest signaled BearShare program updates from FreePeers.inc
 

 Network
 1    : connectionType; Network connection type
 (0=Modem/AOL/ISDN, 1=Broadband/Cable/DSL/Wireless, 2=Satellite, 3=T1/T3/LAN/OC3/Microwave, 4=Custom values)
 6348    : listenPort; TCP/IP port number to listen on
 

 Hosts
 No    : bNeverBecomeUltrapeer; Disable UltraPeer mode
 

 Authentication
 Yes    : bAuthenticateHosts; Authenticate host connections
 Yes    : bAuthenticateDownloads; Authenticate search results and downloads
 

 GBandwidthLogic
 Yes    : bSymmetric; Is Internet connection symmetric
 1024    : totalKbps; Maximum bandwidth for symmetric connections
 256    : sendKbps; Maximum outbound bandwidth for asymmetric connections
 1024    : recvKbps; Maximum inbound bandwidth for asymmetric connections
 No    : bMaxHostsKbps; Limit host bandwidth
 0    : maxHostsKbps; Kbps of send/receive bandwidth to limit hosts
 No    : bMaxUploadsKbps; Limit upload bandwidth
 0    : maxUploadsKbps; Kbps of send bandwidth to limit uploads
 No    : bMaxDownloadsKbps; Limit download bandwidth
 0    : maxDownloadsKbps; Kbps of receive bandwidth to limit downloads
 

 Server
 Yes    : Is Globally Unique Identifier valid
 0xF587 *deleted for privacy*    : 16 character Server Globally Unique Identifier
 

 HostLogic
 No    : m_bEverUltrapeerCapable; Has client ever been an UltraPeer?
 

 FirewallLogic
 No    : bTcpNFW; yes if TCP is not firewalled
 No    : bUdpNFW; yes if UDP is not firewalled
 6348    : UDP Port
 

 Downloads
 C:\My Downloads    : szDownloadsDir; Directory where completed and hashed downloads are moved to
 C:\Program Files\BearShare Test\Temp    : szTempDir; Directory where partial downloads are kept
 8    : dlMaxFiles; Maximum files to download at once
 20    : dlMaxStreams; Maximum connections total
 8    : dlMaxStreamsFile; Maximum connections per file
 Yes    : bDelCompletedDownloads;  ; Automatically remove completed downloads
 Yes    : bEnableSparseFiles; Enable Sparse files for temporary files
 No    : bDisablePushSources; Never send Push messages
 No    : bDisablePushProxySources; Never send Push Proxy requests
 

 Uploads
 8    : maxTotUploads; Maximum files to upload at once
 74    : lastSendBpsMaxAvg; last session average outgoing bandwidth
 

 Firewall testing
 Wasn't able to test ports with http://www3.limewire.com - the website is temporarily inaccessible
 

 Anti-hostiles list
 The current Anti-Hostiles list available on the Internet is dated 26-Jun-2010
 C:\Program Files\BearShare Test\db\BearShareHostiles.zip:  bytes transferred over 7.98 seconds. Download speed is 0Kbps.
 Connect list
 The current Connect list available on the Internet is dated 15-Jun-2010
 Connect.zip:  bytes transferred over 1.51 seconds. Download speed is 0Kbps.

 StartupList report, 7/1/2010, 2:20:03 PM
 StartupList version: 1.52
 Started from : C:\Documents and Settings\Rehab\Desktop\Programs\StartupList.EXE
 Detected: Windows XP SP3 (WinNT 5.01.2600)
 Detected: Internet Explorer v7.00 (7.00.6000.17055)
 * Using default options
 ==================================================
 

 Running processes:
 

 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\Explorer.EXE
 C:\WINDOWS\system32\spoolsv.exe
 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
 C:\WINDOWS\system32\LVCOMSX.EXE
 C:\WINDOWS\ALCXMNTR.EXE
 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
 C:\Program Files\Common Files\Java\Java Update\jusched.exe
 C:\Documents and Settings\Rehab\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
 C:\WINDOWS\system32\rundll32.exe
 C:\WINDOWS\system32\ctfmon.exe
 C:\Program Files\FinePixViewer\QuickDCF.exe
 C:\Program Files\Logitech\SetPoint\SetPoint.exe
 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
 C:\WINDOWS\system32\CTsvcCDA.EXE
 C:\Program Files\Java\jre6\bin\jqs.exe
 C:\WINDOWS\system32\nvsvc32.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\Program Files\Mozilla Firefox\firefox.exe
 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
 C:\WINDOWS\system32\ntvdm.exe
 C:\Program Files\Mozilla Firefox\plugin-container.exe
 C:\Documents and Settings\Rehab\Desktop\Programs\BearDiagNew.exe
 C:\Documents and Settings\Rehab\Desktop\Programs\StartupList.exe
 

 --------------------------------------------------
 

 Listing of startup folders:
 

 Shell folders Common Startup:
 [C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
 Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
 Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
 

 --------------------------------------------------
 

 Checking Windows NT UserInit:
 

 [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
 UserInit = C:\WINDOWS\system32\userinit.exe,
 

 --------------------------------------------------
 

 Autorun entries from Registry:
 HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 

 HPDJ Taskbar Utility = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe"
 NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
 LVCOMSX = C:\WINDOWS\system32\LVCOMSX.EXE
 AlcxMonitor = ALCXMNTR.EXE
 Kernel and Hardware Abstraction Layer = KHALMNPR.EXE
 TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
 avp = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
 QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
 SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

 --------------------------------------------------
 

 Autorun entries from Registry:
 HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 

 NVIEW = rundll32.exe nview.dll,nViewLoadHook
 SansaDispatch = C:\Documents and Settings\Rehab\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
 ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
 

 --------------------------------------------------
 

 Load/Run keys from C:\WINDOWS\WIN.INI:
 

 load=*INI section not found*
 run=*INI section not found*
 

 Load/Run keys from Registry:
 

 HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
 HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
 HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
 HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
 HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
 HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
 HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
 HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
 HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
 HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
 HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
 HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
 HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=C:\PROGRA~1\KASPER~1\KASPER~4\mzvkbd3.dll
 

 --------------------------------------------------
 

 Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
 

 Shell=*INI section not found*
 SCRNSAVE.EXE=*INI section not found*
 drivers=*INI section not found*
 

 Shell & screensaver key from Registry:
 

 Shell=Explorer.exe
 SCRNSAVE.EXE=*Registry value not found*
 drivers=*Registry value not found*
 

 Policies Shell key:
 

 HKCU\..\Policies: Shell=*Registry key not found*
 HKLM\..\Policies: Shell=*Registry value not found*
 

 --------------------------------------------------
 

 

 Enumerating Browser Helper Objects:
 

 (no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
 (no name) - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA}
 (no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
 IEVkbdBHO - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}
 (no name) - C:\Program Files\Yahoo!\Common\yiesrvc.dll - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
 (no name) - (no file) - {AA58ED58-01DD-4d91-8333-CF10577473F7}
 (no name) - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
 (no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
 link filter bho - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll - {E33CF602-D945-461A-83F0-819F76A199F8}
 JQSIEStartDetectorImpl - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll - {E7E6F031-17CE-4C07-BC86-EABFE594F69C}
 

 --------------------------------------------------
 

 Enumerating Task Scheduler jobs:
 

 Google Software Updater.job
 

 --------------------------------------------------
 

 Enumerating Download Program Files:
 

 [Creative Software AutoUpdate]
 InProcServer32 = C:\WINDOWS\DOWNLO~1\CTSUEng.ocx
 CODEBASE = http://www.creative.com/su/ocx/15026/CTSUEng.cab
 

 [iPIX ActiveX Control]
 InProcServer32 = C:\WINDOWS\DOWNLO~1\ipixx.ocx
 CODEBASE = http://www.ipix.com/download/ipixx.cab
 

 [Shockwave ActiveX Control]
 InProcServer32 = C:\WINDOWS\system32\Adobe\Director\SwDir.dll
 CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
 

 [Windows Genuine Advantage Validation Tool]
 InProcServer32 = C:\WINDOWS\system32\legitcheckcontrol.dll
 CODEBASE = http://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab
 

 [Malicious Software Removal Tool]
 InProcServer32 = C:\WINDOWS\Downloaded Program Files\WebCleaner.dll
 CODEBASE = http://download.microsoft.com/download/5/c/2/5c2fc4b7-3875-4eec-946b-ffe15472cabc/WebCleaner.cab
 

 [MUWebControl Class]
 InProcServer32 = C:\WINDOWS\system32\muweb.dll
 CODEBASE = http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1261806992296
 

 [{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
 CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
 

 [Shockwave Flash Object]
 InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash10d.ocx
 CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
 

 --------------------------------------------------
 

 Enumerating Windows NT logon/logoff scripts:
 *No scripts set to run*
 

 Windows NT checkdisk command:
 BootExecute = autocheck autochk *
 

 Windows NT 'Wininit.ini':
 PendingFileRenameOperations: C:\DOCUME~1\Rehab\LOCALS~1\Temp\GLB1A2B.EXE|||A
 

 --------------------------------------------------
 

 Enumerating ShellServiceObjectDelayLoad items:
 

 PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
 CDBurn: C:\WINDOWS\system32\SHELL32.dll
 WebCheck: C:\WINDOWS\system32\webcheck.dll
 SysTray: C:\WINDOWS\system32\stobject.dll
 WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
 UPnPMonitor: C:\WINDOWS\system32\upnpui.dll
 

 --------------------------------------------------
 End of report, 9,275 bytes
 Report generated in 0.140 seconds
 

 Command line options:
    /verbose  - to add additional info on each section
    /complete - to include empty sections and unsuspicious data
    /full     - to include several rarely-important sections
    /force9x  - to include Win9x-only startups even if running on WinNT
    /forcent  - to include WinNT-only startups even if running on Win9x
    /forceall - to include all Win9x and WinNT startups, regardless of platform
    /history  - to list version history only

 Current task list information for WITSEND, running WIN_XP, Service Pack 3, build 2600
 Details collected on 2010/07/01 14:17:39
 

  PID  Process Name            File Version  Pk Mem Usg. Command line that invoked task
     0 System Idle Process          0.0.0.0         0Mb  ><
     4 System                       0.0.0.0      5.36Mb  ><
   880 smss.exe               5.1.2600.5512      0.48Mb  >\SystemRoot\System32\smss.exe<
   928 csrss.exe                    0.0.0.0      5.24Mb  ><
   952 winlogon.exe           5.1.2600.5512     11.27Mb  >winlogon.exe<
  1000 services.exe           5.1.2600.5755      3.59Mb  >C:\WINDOWS\system32\services.exe<
  1012 lsass.exe              5.1.2600.5512      6.26Mb  >C:\WINDOWS\system32\lsass.exe<
  1180 svchost.exe            5.1.2600.5512      5.05Mb  >C:\WINDOWS\system32\svchost -k DcomLaunch<
  1284 svchost.exe                  0.0.0.0      4.15Mb  ><
  1412 svchost.exe            5.1.2600.5512    211.99Mb  >C:\WINDOWS\System32\svchost.exe -k netsvcs<
  1456 svchost.exe            5.1.2600.5512      3.36Mb  >C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup<
  1804 svchost.exe                  0.0.0.0      5.83Mb  ><
  2040 explorer.exe           6.0.2900.5512      37.5Mb  >C:\WINDOWS\Explorer.EXE<
   232 spoolsv.exe            5.1.2600.5512      5.02Mb  >C:\WINDOWS\system32\spoolsv.exe<
   456 hpztsb05.exe               2.128.0.0       3.9Mb  >"C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" <
   792 LVCOMSX.EXE               8.4.7.1036      5.63Mb  >"C:\WINDOWS\system32\LVCOMSX.EXE" <
   804 ALCXMNTR.EXE                 1.5.0.0      4.25Mb  >"C:\WINDOWS\ALCXMNTR.EXE" <
   516 realsched.exe              0.1.1.494       2.8Mb  >"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot<
   840 avp.exe                    9.0.0.736      7.54Mb  >"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" <
   864 jusched.exe                  2.0.2.1      2.48Mb  >"C:\Program Files\Common Files\Java\Java Update\jusched.exe" <
  1084 SansaDispatch.exe            1.0.0.9      3.28Mb  >"C:\Documents and Settings\Rehab\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" <
  1016 rundll32.exe           5.1.2600.5512      5.38Mb  >rundll32 nView.dll,nViewInitialize<
  1212 ctfmon.exe             5.1.2600.5512      3.55Mb  >"C:\WINDOWS\system32\ctfmon.exe" <
  1232 QuickDCF.exe                 4.0.0.0      3.43Mb  >"C:\Program Files\FinePixViewer\QuickDCF.exe" <
  1256 SetPoint.exe               4.72.40.0      11.3Mb  >"C:\Program Files\Logitech\SetPoint\SetPoint.exe" <
  1348 KHALMNPR.exe               4.72.24.0      6.06Mb  >KHALMNPR.EXE /API<
  1724 svchost.exe                  0.0.0.0      3.47Mb  ><
  1764 avp.exe                    9.0.0.736    109.57Mb  >"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" -r<
  1780 CTSVCCDA.EXE                 1.0.1.0       1.5Mb  >C:\WINDOWS\system32\CTsvcCDA.EXE<
  1888 jqs.exe                    6.0.200.2     16.38Mb  >"C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"<
  1952 nvsvc32.exe             6.14.10.4523      3.52Mb  >C:\WINDOWS\system32\nvsvc32.exe<
  1584 svchost.exe            5.1.2600.5512       4.5Mb  >C:\WINDOWS\system32\svchost.exe -k imgsvc<
  2840 alg.exe                      0.0.0.0      3.59Mb  ><
  3708 svchost.exe            5.1.2600.5512      3.45Mb  >C:\WINDOWS\System32\svchost.exe -k HTTPFilter<
   592 firefox.exe               1.9.2.3828    133.54Mb  >"C:\Program Files\Mozilla Firefox\firefox.exe" <
  3648 klwtblfs.exe               9.0.0.736       4.3Mb  >"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe" -Embedding<
   856 ntvdm.exe              5.1.2600.5512      6.21Mb  >"C:\WINDOWS\system32\ntvdm.exe" -f -i2 -ws -a C:\WINDOWS\system32\krnl386.exe<
  3456 rundll32.exe           5.1.2600.5512     15.05Mb  >"C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\shell32.dll,Control_RunDLL "C:\WINDOWS\system32\appwiz.cpl",Add or Remove Programs<
   404 plugin-container.exe      1.9.2.3828     22.88Mb  >"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel=592.9540de0.1299286939 "C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll" 592 plugin \\.\pipe\gecko-crash-server-pipe.592<
  3728 BearDiagNew.exe            1.99.26.0     15.13Mb  >BearDiagNew.exe<
  1132 wmiprvse.exe                 0.0.0.0      6.57Mb  ><
 

 

 BearShare library folder information for WITSEND, running WIN_XP, Service Pack 3, build 2600
 Details collected on 2010/07/01 14:22:08
 

  Volume in drive C has no label.
  Volume Serial Number is 94A7-5A69
 

  Directory of C:\Program Files\BearShare Test\db
 

 07/01/2010  02:21 PM    <DIR>          .
 07/01/2010  02:21 PM    <DIR>          ..
 09/18/2009  10:32 AM    <DIR>          __MACOSX
 12/12/2005  01:25 AM           644,608 720A_JY08.exe
 09/18/2009  10:32 AM    <DIR>          Bearshare-cache
 07/01/2010  02:21 PM         1,734,839 BearShareHostiles.zip
 08/06/2006  01:50 AM             3,103 config.bin
 07/01/2005  01:59 PM             3,103 config.bin.bak
 06/16/2010  02:09 PM           164,274 connect.txt
 07/01/2010  02:22 PM            34,795 connect.zip
 08/06/2004  09:10 PM           334,848 DriveCheck.exe
 01/29/2009  07:08 PM               174 DriveCheck.log
 06/13/2010  01:22 AM             2,479 gwebcache.dat
 06/19/2009  06:31 AM        12,795,683 Hostiles.old
 06/26/2010  12:31 PM        15,712,397 hostiles.txt
 06/13/2010  01:22 AM                 0 Hostiles-Chat.txt
 02/01/2007  07:50 AM             2,870 how to use the list.txt
 02/01/2007  07:50 AM             2,870 how to use the list_1.txt
 06/16/2010  02:11 PM         2,483,200 library.2.db
 06/13/2010  01:21 AM         2,481,152 library.2.db.lastgoodload.bak
 06/16/2010  02:11 PM         2,483,200 library.db
 06/13/2010  01:21 AM         2,481,152 library.db.lastgoodload.bak
 06/13/2010  01:22 AM                19 searches.ini
               19 File(s)     41,364,766 bytes
                4 Dir(s)  13,316,669,440 bytes free

 Firewall information for WITSEND, running WIN_XP, Service Pack 3, build 2600
 Details collected on 2010/07/01 14:22:08
 

 IP Address is      xxx.xxx.x.x
 Subnet mask is     255.255.255.0
 Default gateway is 192.168.2.1192.168.2.1  
 DHCP is enabled.
 Valid Firewall exception for program C:\Program Files\BearShare Test\BearShare.exe found
 Valid Firewall exception for TCP port 6348 found
 Valid Firewall exception for UDP port 6348 found
 

 

 Domain profile configuration:
 -------------------------------------------------------------------
 Operational mode                  = Enable
 Exception mode                    = Enable
 Multicast/broadcast response mode = Enable
 Notification mode                 = Enable
 

 Service configuration for Domain profile:
 Mode     Customized  Name
 -------------------------------------------------------------------
 Enable   No          UPnP Framework
 

 Allowed programs configuration for Domain profile:
 Mode     Name / Program
 -------------------------------------------------------------------
 Enable   Remote Assistance / C:\WINDOWS\system32\sessmgr.exe
 Enable   MSN Messenger 7.5 / C:\Program Files\MSN Messenger\msnmsgr.exe
 Enable   Network Diagnostics for Windows XP / C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
 

 Port configuration for Domain profile:
 Port   Protocol  Mode     Name
 -------------------------------------------------------------------
 1900   UDP       Enable   SSDP Component of UPnP Framework
 2869   TCP       Enable   UPnP Framework over TCP
 

 Standard profile configuration (current):
 -------------------------------------------------------------------
 Operational mode                  = Enable
 Exception mode                    = Enable
 Multicast/broadcast response mode = Enable
 Notification mode                 = Enable
 

 Service configuration for Standard profile:
 Mode     Customized  Name
 -------------------------------------------------------------------
 Enable   No          UPnP Framework
 

 Allowed programs configuration for Standard profile:
 Mode     Name / Program
 -------------------------------------------------------------------
 Enable   Yahoo! Messenger / C:\Program Files\Yahoo!\Messenger\YPager.exe
 Enable   Yahoo! Messenger / C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
 Enable   BearShare / C:\Program Files\BearShare Test\BearShare.exe
 Enable   Network Diagnostics for Windows XP / C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
 Enable   Remote Assistance / C:\WINDOWS\system32\sessmgr.exe
 Enable   Ad-Aware SE Personal / C:\Program Files\LAVASOFT\Ad-Aware SE Personal\Ad-Aware.exe
 Enable   Spybot - Search & Destroy / C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
 Enable   Kaspersky Anti-Virus 7.0 Setup / C:\kav\kav7\setup.exe
 Enable   Firefox / C:\Program Files\Mozilla Firefox\firefox.exe
 Enable   Kaspersky Anti-Virus / C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
 Enable   NLOP / C:\Program Files\NLOP\PlayPoker.exe
 Enable   RealPlayer / C:\Program Files\Real\RealPlayer\realplay.exe
 

 Port configuration for Standard profile:
 Port   Protocol  Mode     Name
 -------------------------------------------------------------------
 6346   TCP       Enable   Bearshare
 6346   UDP       Enable   Bearshare
 6348   TCP       Enable   Bearshare
 6348   UDP       Enable   Bearshare
 1900   UDP       Enable   SSDP Component of UPnP Framework
 2869   TCP       Enable   UPnP Framework over TCP
 

 ICMP configuration for Standard profile:
 Mode     Type  Description
 -------------------------------------------------------------------
 Enable   8     Allow inbound echo request
 

 Log configuration:
 -------------------------------------------------------------------
 File location   = C:\WINDOWS\pfirewall.log
 Max file size   = 4096 KB
 Dropped packets = Disable
 Connections     = Disable
 

 Local Area Connection 5 firewall configuration:
 -------------------------------------------------------------------
 Operational mode                  = Enable
 

 uPnP devices
 2 devices found
 

 Manufacturer: Belkin International
 Model: N Wireless Router, Model Number: F5D8236-4 v3
 Model URL: http://www.belkin.com/
 Manufacturer URL: http://www.belkin.com/
 Presentation URL: http://192.168.2.1/index.html
 

 Manufacturer: Belkin International
 Model: N Wireless Router, Model Number: F5D8236-4 v3
 Model URL: http://www.belkin.com/
 Manufacturer URL: http://www.belkin.com/
 Presentation URL: http://192.168.2.1/index.html

 Logfile of HijackThis v1.99.1
 Scan saved at 2:20:11 PM, on 7/1/2010
 Platform: Windows XP SP3 (WinNT 5.01.2600)
 MSIE: Internet Explorer v7.00 (7.00.6000.17055)
 

 Running processes:
 C:\WINDOWS\System32\smss.exe
 C:\WINDOWS\system32\winlogon.exe
 C:\WINDOWS\system32\services.exe
 C:\WINDOWS\system32\lsass.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\Explorer.EXE
 C:\WINDOWS\system32\spoolsv.exe
 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
 C:\WINDOWS\system32\LVCOMSX.EXE
 C:\WINDOWS\ALCXMNTR.EXE
 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
 C:\Program Files\Common Files\Java\Java Update\jusched.exe
 C:\Documents and Settings\Rehab\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
 C:\WINDOWS\system32\rundll32.exe
 C:\WINDOWS\system32\ctfmon.exe
 C:\Program Files\FinePixViewer\QuickDCF.exe
 C:\Program Files\Logitech\SetPoint\SetPoint.exe
 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
 C:\WINDOWS\system32\CTsvcCDA.EXE
 C:\Program Files\Java\jre6\bin\jqs.exe
 C:\WINDOWS\system32\nvsvc32.exe
 C:\WINDOWS\system32\svchost.exe
 C:\WINDOWS\System32\svchost.exe
 C:\Program Files\Mozilla Firefox\firefox.exe
 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe
 C:\WINDOWS\system32\ntvdm.exe
 C:\Program Files\Mozilla Firefox\plugin-container.exe
 C:\Documents and Settings\Rehab\Desktop\Programs\BearDiagNew.exe
 C:\Documents and Settings\Rehab\Desktop\Programs\HijackThis2.exe
 

 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;localhost
 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
 O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
 O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
 O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
 O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
 O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
 O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
 O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
 O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe"
 O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
 O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
 O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
 O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
 O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
 O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
 O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Rehab\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
 O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/5.0_(Windows;_U;_Windows_NT_5.1;_en-US;_rv:1.9.1.5)_Gecko/20091102_Firefox/3.5.5_(.NET_CLR_3.5.30729)" -"http://highered.mcgraw-hill.com/olcweb/cgi/pluginpop.cgi?it=dcr::730::400::/sites/dl/free/0073522821/154131/match12_01.dcr::Matching%20Quiz%201"
 O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
 O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
 O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
 O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
 O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
 O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
 O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
 O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
 O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
 O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
 O11 - Options group: [INTERNATIONAL] International*
 O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
 O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1261806992296
 O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~4\mzvkbd3.dll
 O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
 O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
 O20 - Winlogon Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
 O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
 O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
 O23 - Service: Kaspersky Anti-Virus (avp) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" -r (file missing)
 O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
 O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
 O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
 O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
 O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
 O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
 

 

 .

[MoreBandwidthPls]

Thanks for the BearDiag listing - it answers a lot of questions before I have to ask them.

1. Did you install from CD or off the net? If off CD, search for any files on there called unwise.ex? (the last letter could be anything). Advise if any found.

2. Have you deleted the installation folder by mistake? C: Program Files\You Dont Know ...whatever..... ? Is the folder still there? Does it have a file called unwise.exe in there, or any subfolders?

3. Are you uninstalling from the same account/login as it was installed from?

4. Have you checked your disk drive for errors? Advise the results.

5. Is the file C:\windows\unwise.exe present on your machine? If not, search and advise if located elsewhere also (there may be multiple instances).

6. Check the log in Kaspersky, if it has blocked anything around the time you installed or attempted uninstallation. Any mention?

[Aaron.Walkhouse]

Easy fix: Search the disk for another copy of unwise.exe and copy it to the Windows folder.

Some software developers make the mistake of letting their WISE uninstall scripts remove
the copy in there without checking to see if other programs use it too.

If you can't find one I'll send a copy to you.

[web_girrly]

Terry installed it--from where I do not know. I'll have to wait until he wakes up before I can ask him. When he got his laptop (thank you God) I uninstalled all the poker and other programs. I may have done only a partial uninstall of YDKJ. I'll dive into this after my bike ride :-)

[web_girrly]

Originally Posted by MoreBandwidthPls

Thanks for the BearDiag listing - it answers a lot of questions before I have to ask them.

1. Did you install from CD or off the net? If off CD, search for any files on there called unwise.ex? (the last letter could be anything). Advise if any found.

Ter installed it off a cd. Whereabouts of cd unknown.

Originally Posted by MoreBandwidthPls

2. Have you deleted the installation folder by mistake? C: Program Files\You Dont Know ...whatever..... ? Is the folder still there? Does it have a file called unwise.exe in there, or any subfolders?

Probably. I did a search for the file containing any part/words and results are zero.

Originally Posted by MoreBandwidthPls

3. Are you uninstalling from the same account/login as it was installed from?

Yes, there are no special login privileges. Anyone can walk in from off the street and once they make it past the gate and the dogs, they are free to hop on my machine.

Originally Posted by MoreBandwidthPls

4. Have you checked your disk drive for errors? Advise the results.

Did a C and D drive check. they are clean. at least I think. It takes so long I usually go off and do something and come back when it's all done. Think I missed something? I set it to "check for errors" and "automatically fix errors".

Originally Posted by MoreBandwidthPls

5. Is the file C:\windows\unwise.exe present on your machine? If not, search and advise if located elsewhere also (there may be multiple instances).

See item number 2. Unless there is another way to locate it besides using the Search function.

Originally Posted by MoreBandwidthPls

6. Check the log in Kaspersky, if it has blocked anything around the time you installed or attempted uninstallation. Any mention?

Not sure. All I see are Rootkit Scans under "objects scan"and the other tabs come up clean.

[MoreBandwidthPls]

Thanks for the update.

From what you have indicated, it appears the installed folder has been deleted, rather than un-installed. This can result in system instability if there are files still pointed to by other programs. To remedy this, some people advise to re-install the program (impossible as you don't have access to the original CD), or alternatively just remove the entry in the 'installed programs' and hope there are no software conflicts.

Lets run C:\Documents and Settings\Rehab\Desktop\Programs\HijackThis2.exe (a veritable Swiss army knife when it comes to fixing things - sleek and powerful) and have a bit of a look at what the uninstall program settings are.

From the first screen, press the 'open misc tools section' button. Press the 'open uninstall manager' button.

You should see a screen similar to that in your 'add/remove programs' option found in the control panel in Windows, except here you can see what is behind the button when you select the uninstall option.

Find your program name, highlight it with a left click and then press the 'edit uninstall command' button on the right. Highlight/select all the details in the popup screen and copy them to the windows clipboard (press the copy CTRL-C keys), and post that part in your reply here (press the paste CTRL-V keys) from the same clipboard. You can exit out of HijackThis after that.

[web_girrly]

c:\windows\YDKJ2\uninst.exe

I have a feeling I was supposed to get a longer bit of text. I may have missed something. Thank the Maker for screen shots.

[MoreBandwidthPls]

Is there a folder called YDKJ2 in the Windows folder?
What files are in it? (A screen shot will be OK if you have a few)

[web_girrly]

Yes I have a few. But none are named YDKJ. I left out the first couple pages of files, which are more of the ones that begin with Uninstal appearing in screenshot 1.

[Aaron.Walkhouse]

I see a folder called YDKJ2 in the Windows folder.

[web_girrly]

Serious?? Good thing I posted the pics. I'll go in for a closer look. Thank you Aaron.
{UPDATE}
O.M.G. If it was a snake it would have bit me? Wow I am blind!

[iissmart]

But why would you want to uninstall You Don't Know Jack? I grew up with "screwing" people in that game...one of the many videogames I played during my childhood. The only reason I haven't re-installed it, is because I had the Mac version

[web_girrly]

I was just going through one day and doing a little housecleaning. I saw it and said, hey, what's that doing there? Thus began the saga. When my bf and I shared this machine he had all sorts of games, mainly his poker stuff. I never play it. This machine is 8 years old. Has extra memory installed but still, I treat it as one would an old car: gently. And you can see what an imbecile of a mechanic I am.
Good to see you, iis, it's been a while :-)

[MoreBandwidthPls]

Aha, the file is there, but possibly the location is configured poorly in the software. Try copying the file unwise.exe from c:\windows\ydkj2\ to c:\windows\ and then repeat the uninstall actions as you first attempted. Advise results.

A grease and oil change and a run around the block can work wonders for a ailing sportster. Get the carbon out from the rings.

[web_girrly]

Bingo! Copied the file to Windows/went to Add or Remove Programs/ hit remove/ Blue uninstall screen pops up and there she goes!

Only thing is, I cannot close the AORP window. It will not even reduce, and the YDKJ2 is still listed.

[UPDATE]

I left it alone for a couple hours. When I came back the pop-up screen asking to restart for changes to take effect was finally there. Clicked it, it restarted, YDKJ2 is gone from programs list and all is well in the jungle tonight.

Thank you. A small thank you of support shall be mailed off to Julie. It is a pittance compared to what you do.

yes I am mailing you a beer

[MoreBandwidthPls]

Good news!

I suspect that version of unwise was a very old one (1996?) and it didn't keep track of how many times it had installed itself in Windows so removed it as part of some other uninstall you did earlier. The counters in the Windows registry often don't get updated correctly when very old software is installed in later generations of the operating system as Microsoft and the programmers don't often look into the future...

As a final cleanup, remove that unwise.exe file you copied to the c:\windows folder, and check there are no remnants of the c:\windows\YDKJ2 and c:\program files\YDKJVOL2 folders still present. If the folders still exist, it should now be safe to delete them manually.

Bonus: I notice a large number of text files starting with KBxxxx.log in your c:\windows folder that are part of the regular windows update process. You may not need these, and can probably safely delete any with a modification date of more than two months old. The files relate to the Microsoft knowledge base article that explains what the update relates to, and the file modification date is the time the patch was applied to your system. Eg: KB834707.log relates to a security update from 2006 - reference http://support.microsoft.com/kb/834707 and although the update is still valid, the log file is only cluttering up your hard drive. You should not uninstall the patch, as it probably is still current, or may have been overwritten with further updates but still have residual dependencies, but the installation log is long past the relevance date. The file name and knowledge base article numbers correspond, so if you have a burning curiosity and the spare time, look them up - I just clean them up every so often leaving the ones from a last two or three updates there just in case I need to uninstall them at some stage.

I'll pass on the beer as I abstain, but thanks for the kind sentiments.

[web_girrly]

Super! That makes two of us. I first thought to buy you a cup of coffee, but the icon, well, it looks like a lonely, solitary thing, doesn't it?

Whenever I have an assignment or lecture full of ideas to wade through, I copy it to a Word doc and break it down, literally, into numbered sentences so that I may understand it. That is what I am doing with the recommendations you provided on file cleanup. Will advise on progress ;-)

[UPDATE]

1. Deleted remnants of YDKJ2. Thank you :-)

2. Chose a few KB files at random to check for modification date. The following one is a curiosity. It says it was last accessed yesterday, but the mod date is from 2005. I didn't open it, how was it accessed and would it still be OK to delete?