Help - Pgate Basic [solved]

[witenoiz]

I have a friends Dell for a few days for some major clean-up. After getting rid of 3 toolbars in IE6 I have one thing left in the add-remove option in XP programs. When I click on REMOVE - it asks the usual are you sure YES or NO and when I click YES it takes me to a website and I have no idea what to do - I certainly don't want to download whatever could be waiting for me. I had never heard of this before ( Never heard of I-Lookup either ) that one is fun!!! Any advice on this one? Jack

[primesuspect]

http://www.short-media.com/article.php?131.0

Use the cocktail method. You can't rely on scumware "uninstallers" which may actually install MORE crapware.

[witenoiz]

I am very uninformed about this. What the _ is the cocktail method?

[primesuspect]

It's described in my article. You use a combination of hijackthis, adaware, and cwshredder to eliminate all the crapware from your computer.

[witenoiz]

I read the article and kind of skipped over that part - I have run Spybot, Adaware, Hijack This, CWShredder, RegVac, of course Norton - so my reply was kind of "been there done that - I need help" IF I knew how to get the problem program, I would pick up a cheapy box tomorrow and install it and then try that screen. Everything I have works and I have this guys box working almost flawless - put in some safeguards so his kids can't get this stuff again and haven't had a pop-up in 2 days. I just want that programmy off and I need someone that has tried that to give advice. Your right - that uninstaller (if that is what it is) would probably add more scum ware - I like that wording. If it was my box - I would wipe it clean and start over. They share it with their kids ( YIKES!! ) so I have it protected. Well, untill they give the kids the passwords. Thanks anyway Prime - the asnwer my friend is out there - or it is blowin' in the wind. Jack

[drewcoleman]

Me too. I've done the cocktail method listed above, and also run Search and Destroy. PGate Basic is still there. Nobody seems to know how to get rid of it.

[Kwitko]

After some searching, I found out it may be related to something called PromulGate, also called Delfin Media Viewer.

Give these (http://www.kephyr.com/spywarescanner/library/promulgate/index.phtml) uninstall instructions a shot.

[witenoiz]

I was afraid of what the "Download Now" might add to rather than take off. Like primesuspect said you can't trust these scumware 'tools'. I had an option though - the people who own the computer were expecting a new install. I clicked the link and it took care of the problem. Jack

[JAG6177]

Me too. I've done the cocktail method listed above, and also run Search and Destroy. PGate Basic is still there. Nobody seems to know how to get rid of it.

Hey guys, I just got rid of the PGate Basic that was in my add/remove folder, by going to the site and running it's uninstall program. I wasn't sure what else I might be getting, but I have sense run all of my spyware detection programs, and my virus detector, and have not come up with anything new. I really hope this helps. Normally, I wouldn't have downloaded the uninstaller, but I wanted that out of my add/remove programs list. Like I said, hope this helps.

[sideshow bob]

I'm having a problem with Pgate, and the uninstaller is no longer available. When you go the site to download it the address the file is linked to is bunk. Here's my Hijack This log:


Logfile of HijackThis v1.97.7
Scan saved at 5:10:27 PM, on 4/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\sysupd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\MIKE~1.BEA\LOCALS~1\Temp\Rar$EX00.703\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: (no name) - {80672997-D58C-4190-9843-C6C61AF8FE97} - C:\WINDOWS\rundll16.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\sysupd.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1954A4B1-9627-4CF2-A041-58AA2045CB35} (Brix6ie Control) - http://a19.g.akamai.net/7/19/7125/1269/ftp.coupons.com/v6/brix6ie.cab
O16 - DPF: {1E89F686-B78D-4C85-9EFC-3474516E3FE2} - http://goinnow.com/plugin/111928.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/19b058372c22e80ba205/netzip/RdxIE601.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003050501/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D32C3BAD-5213-49BD-A7D5-E6DE6C0D8249} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {EF86873F-04C2-4A95-A373-5703C08EFC7B} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab

Anyone think they can help? :woowoo:

[witenoiz]

I just tried this link and it works... http://pgate-basic.com/uninstall.shtml

Jack

[Leonardo]

Anyone try:

- Manually delete all Pgate crap you can find (look manually, then use Search)
- RegCleaner to wipe out the remnants. RegCleaner has performed miracles for me before. It's particularly effect for cleaning garbage out of "Add/Remove Programs" in Control Panel.