ozonedman

Originally posted by a1_andy: One thing i can say is its been makeing us Comp tec's lots of work, but i never feel good reformating a customers comp. I'd perfer to remove the culprit('s) instesd. So would I, formatting is a last resort most of the time. Lately, though, the crap has been getting smarter, and it's getting personal. Damned if I'll let them get the best of me.

Yep, RC probably would have worked, was in the system32 directory. I just had Winternals sitting here next to me, as I use it regularly enough. Struck me as interesting, I take this crap out of systems daily, first one that I've seen loads in Safe mode. Part of the ease (for lack of a better term) of taking out crapware HAS been the fact of recognizing more recent dates in the files, I've only seen a couple using older dates. When the scumbags get smarter and put old file dates.... then the job gets harder.

Didn't go thru your way, I found it differently. I happened to remember the original name I started deleting, AND the creation date. After a couple frustrating hours, I searched the DATE and found the original filename in the \restore\temp directory. (WinMe) with an extension of .o along with a couple other files on the drive from that date (7/24/2004). Not sure yet what else was interconnected, but this seems to have killed it. Incidentally, two days ago I cleaned one that actually loaded in Safe mode in XP! Couldn't be deleted. Had to boot from Winternals CD (not cheap) attach to the XP installed, and delete the file. Worked like a charm.