Anyone know how to remove this from a WinXP Pro computer? Its on an Acer Travelmate 400 1L Ci . It keeps showing up on Spybot scans, and even after having Spybot remove it, it comes right back. I disabled System Restore before scanning, and it doesnt seem to matter, as its somewhere in the registry, and just renews itself. Is there a removal tool that will take this thing out? If so, I cant find it by Googling it. Thanks!
chris ******************************************************* 07-24-05, 05:39 PM bedstor Chris I know you've posted on the http://www.webuser.co.uk/forums before Go to the Hijackthis forum follow the instructions in the top "pinned" post and submit a log The log readers will tell you what to do to remove this item case of ticking a menu item or 2 to clear it (not a program for the average person)If you do this on "guessing" there is a good chance you can do irrepairable damage to progams or Windows!! Frown ******************************************************* 07-24-05, 06:05 PM vansrme Thanks bedstor, I just hadnt got around to them yet! lol I'll head to there now, after I download the hijackthis program to this pc!
chris ******************************************************* 07-24-05, 06:48 PM bedstor Anything thats an "unknown" or"non removable" I always refer to this forum if I don't have a clue Have another site with an active forum for this program worth posting to for a second opinion? http://www.daniweb.com but this is a more specialised site (worth bookmarking)
Late news MagicControl? I found quite a bit on it including some removal routines, but a HJT log reply might have an easier way? PPS There is a manual removal routine on this Page, but you have to determine what variant is lodged in your registry first (there are several And MagicControl is listed in the Spywareblaster block list. Have you got that running on your computer? ******************************************************* 07-24-05, 10:41 PM vansrme I posted it on webuser.com , and am awaiting a response, thanks for the reminder! I've tried Pest Patrol too, and it didnt even find the MagicControl.Agent . This thing must be near impossible to get rid of, I cant find hardly anything thats very useful on getting it out of my system. I need to get rid of it soon though, as its on a friend's laptop, and he needs it in a few days at most.
chris ******************************************************* 07-24-05, 11:17 PM bedstor This page has the manual removal instructions Chris (if you want to try?) http://www.doxdesk.com/parasite/MagicControl.html Once its gone put a copy of SpywareBlaster on the computer to keep it out Smile ******************************************************* 07-25-05, 12:34 PM vansrme bedstor, I used the Doxdesk instructions, but every file or folder it said to remove was not there. I'm about to check with webusers to see if there's a reply to that post.
chris ******************************************************* 07-25-05, 12:51 PM bedstor Chris It must be a different strain? Some of those submissions are out of date on Doxdesk Roll Eyes ******************************************************* 07-25-05, 08:51 PM cswchan Try THIS from Trend Micro. Good luck.. ******************************************************* 07-25-05, 10:28 PM vansrme cswchan, I tried that link, but got a "Page cannot be displayed" message.
chris ******************************************************* 07-25-05, 10:33 PM cswchan http://www.trendmicro.com/vinfo/grayware/ve_graywareDet...?GNAME=ADW_SLAGENT.A Try that instead. C. ******************************************************* 07-26-05, 08:59 AM vansrme That link is better, LOL. I ran that scan last night, and got rid of what it found, a Generic dialer, but this item is still there. I just ran Reg Supreme 1.3, and this is what it found, along with everything I've tried so far:
Reg Supreme 1.3 found 116 items, and cleaned them out, but none matched any descriptions of MagicControl.Agent, which I'm beginning to believe can only be gotten rid of by re-formatting. I've tried Microsoft Anti Spyware, Spybot, Ad Aware, CCleaner, Reg Supreme, Ewido Security Suite, Win Patrol, Pest Patrol, HiJackthis and CWShredder to get rid of it, and its still there, but only Spybot will find it. Anyone have any idea why Spybot is the only one that can find it? The Egroup dialer keeps coming back as well, which I know is related to MagicControl.Agent. Is there not a way to get rid of this piece of garbage?
well, there's 3 of them. One thing that I have learnt is that you may have to bootup in safe-mode before deleting some of these malicious programs. Safe-mode is usually achieved by pressing on F8 during the boot sequence before the "Windows" logo shows up, almost as soon as you hit the power button on the computer. Good Luck ******************************************************* 07-26-05, 11:33 AM vansrme I've been booting into Safe Mode to run most of these scans anyway, unfortunately, it hasnt helped alot, but I'll check into those links, and see what happens. Thanks!
chris ******************************************************* 07-26-05, 11:35 AM vansrme The second link was the only one that worked, the other two give me the Page cannot be displayed message. The second link describes the malware, but doesnt help to get rid of it. I'll keep looking. lol
chris ******************************************************* 07-26-05, 11:47 AM bedstor As regards the Egroup issue There are 3 removal instructions listed on the link below If it was marked egroup E-group Sex dialer then the item to find (in the Registry) are not to many to find....but time consuming Frown The other 2 are tricky E-group Sex dialer Mad(Which is not resident on your computer) And EGroup (correct spelling?) This is a real stinker!! Mad Check out how many possible entries have to be deleted on this link Going to have to take your time on this, and at least isolate the respawning part (Don't ask me! Confused)LOL Then go from there. Sorry to be the bearer of bad news Might be worth your time paying a workshop to remove it? Ps Scroll down the page and you'll see the links for the other similar named "Egroup" variants (massive list of other pests as well) BTW This Dialler is not on Spywareblasters Block list Mad ******************************************************* 07-26-05, 12:59 PM vansrme bedstor, That program found something alright, but would not remove it without me buying it, so I guess I'll have to try the manual removal. LOL
Thanks alot! chris ******************************************************* 07-26-05, 05:24 PM bedstor Chris Despite their "promises" the "free trial" is always finished when you download the program All they want to see is the color of your cash Frown then they'll make an excuse that the software doesn't clear "your" variant Frown Have you tried the Microsoft antispyware program on that computer yet? That is very strong it might have this in its database? Program is 6.5 MB in size. Try scanning with this program before going to manual removal Smile Will take an hour or so(first scan) then gets faster and faster on subsequent scans takes 20-25 mins now BTW It will pick a lot up on the first scan (settling in) then less and less as the nasties are deleted. Does pick up "False positives" Roll Eyes But after settling in and the things you know for definite are trouble are deleted ( or quarantined) Roll Eyes You can browse as normal Smile I rate this even stronger than AdAware for scanning Wink ******************************************************* 07-26-05, 10:49 PM vansrme Yep, tried the MS Spyware remover, it got rid of the Egroup dialer, but not the MagicControl.Agent that keeps popping up in Spybot. Every now and then, Spybot will give me a clean scan, but then its right back.
chris ******************************************************* 07-26-05, 11:25 PM vansrme bedstor, I've done some work in the registry before, so I'm ok with trying the manual removal instructions in the link above that you provided, but I'm not sure where all those files,directories and registry keys are exactly. Could you point me in the right direction?
chris ******************************************************** 07-27-05, 11:48 AM bedstor MagicControl.Agent removal. Hi Chris If the only option is to go into the Registry Then I admit I haven't a clue where to look either Frown BUT... there is a good search link See Edit on the top of the frame? The 2 bottom links on the menu are the Find links for searching (Spywareblaster has a similar search on its program)
TIP:Click the top link on the list to start the search and you won't miss anything Wink Have to do this every time Frown press F3 to continue to the next location if it exists? Puts up a message if there are no matches OK Note-SpywareBlasters version lacks this trick have to keep selecting "Find next" manually Roll Eyes Have a feeling if you clip some of those tails A Registry clean with Crapcleaner (Issues Icon) might clear the rest? Roll Eyes ******************************************************** 07-27-05, 12:24 PM vansrme bedstor, Which program do you mean for these links in the Edit section?
chris ******************************************************** 07-27-05, 12:58 PM bedstor Regedit chris I Omitted it from the posting Red Face (bit rushed today) Sry about that. ******************************************************** 07-27-05, 11:17 PM vansrme No problem, I think we may have gotten rid of it, but I'm scanning the heck out of it to be sure. I'm still finding a generic dialer though with the Ewido Security suite scanner. I've removed it several times so far, its named msclock.dll or something like that. I'll probably have to go back into the System32 folder, and delete that. Thanks for all the help!
chris ******************************************************** 07-27-05, 11:37 PM bedstor Pleased for you Big Grin When you return the computer tell them to keep the antispyware updates and scans going the Microsoft program is set to scan(on my computer) at 11:30 every night for 20 mins and updates itself. Leave the Spywareblaster ,Avast! and AdAware SE Programs on it as well thats a good combination to keep nasties away Wink ******************************************************** 07-28-05, 07:01 AM vansrme Thanks for the help bedstor! I cant find any traces of it now. Have a good one!
chris
This message has been edited. Last edited by: DorianGreyed,
Posts: 822 | Location: Wytheville, va. USA | Registered: 09-03-02
