MRU blaster has stopped cleaning temporary Internet files only cookies??

Did exactly as you advised. First message"are you sure you want to add to registry" Clicked OK then second message "Cannot import e: Error opening the file. There may be a disk or file system error. Clicked OK
Third message "Are you sure you want to add the information in C:\mru.txt to the registry". Clicked OK Fourth message cannot import etc last try to import HKEY local etc failed.

 

If you copied the whole portion I had in bold exactly....it should not be attempting to add anything....only exporting that info and placing it in a file called mru.txt

Just to make sure....what hard drive letter is your system working from ?

 

C:\ drive

 

Then you have issues other than MRUblaster that's for sure especially if those type error messages are coming back from a simple regedit extract command. You can double check you have copied\pasted exactly as advised and try again....otherwise I'm about out of ideas what is wrong with your system but it's not MRUblaster IMMHO.

By chance did you look in the root of C: drive and did you see the mru.txt file ?

Bubba

 

I have tried again by copy and paste and can see in "my computer" the file mru text document. On opening I see: MRU-Blaster, Cookies Blaster,Scheduler

 

As requested above....will you post the contents Please....all of the contents.

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster]

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\CookieBlaster]
"Location"="C:\\Documents and Settings\\Ken Admin\\Cookies"

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\Scheduler]
"Scan Interval"=dword:0000000f
"Minutes"=hex:ff,ff
"Seconds"=hex:00,00
"Hours"=hex:00,00

 

Thank You.

Well....if you actually went to the TIF plugins and selected Save Settings + Run Now as requested above....then some software you have is preventing or has prevented the MRU-Blaster\IECache key to be written.

If you indeed did the TIF plugin and have not re-booted the machine:

Click Start button > Run > and copy the below bold command into the window exactly:

regedit.exe /e C:\mru.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"

Click OK to execute that command. If done correctly this will create the file C:\mru.txt

Find that file and post the contents Please....all the contents.

Thanks,
Bubba

 

Hello Bubba, I just lost my internet connection so I don't know what you received here is the copy of the mru file.


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster]

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\CookieBlaster]
"Location"="C:\\Documents and Settings\\Ken Admin\\Cookies"

[HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster\Scheduler]
"Scan Interval"=dword:0000000f
"Minutes"=hex:ff,ff
"Seconds"=hex:00,00
"Hours"=hex:00,00

 

Sorry about your Interent connection. Is that the contents of mru.txt after accomplishing the request in post # 34 above ?

If so....then delete that mru.txt file and accomplish the request in post # 34 above Please.

 

I'm back with you,

indows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MRUBlaster"="C:\\Program Files\\MRU-Blaster\\indexcleaner.exe -COOKIES"

 

Please don't think I am harping but I have to ask....did you actually go to the TIF plugins and select Save Settings + Run Now as requested above ?

That RunOnce entry should say....Program Files\\MRU-Blaster\\indexcleaner.exe -CC....if you indeed selected both of the plugins as requested earlier.

 

This is the post after pasting from 34 above. I have been again to the plugins selected save settings +run on both TIF's and cookies.
and repeated the pasting of 34
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MRUBlaster"="C:\\Program Files\\MRU-Blaster\\indexcleaner.exe -COOKIES"
-----------------------------------------------------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MRUBlaster"="C:\\Program Files\\MRU-Blaster\\indexcleaner.exe -COOKIES"

 

Well...well....I am about out of ideas

If you wish to try one other thing then I'll ask you to go into the registry and delete any entries dealing with HKLM/software/MRU Blaster and also remove the MRUblaster entry from the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce key....reboot and after you re-boot....go into the registry and make sure the keys and entries were actually removed. If they were not say so....but if they were then I'll ask that you run the TIF plugin and select Save Settings + Run Now.

As soon as you have done that:

Click Start button > Run > and copy the below bold command into the window exactly:

regedit.exe /e C:\mru.txt "HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster"

Click OK to execute that command. If done correctly this will create the file C:\mru.txt

Find that file and post the contents Please.

Bubba

 

I have rebooted and the HKLM/software MRU Blaster is still there as is the runonce key.

I am going to bed now. Thank you for your help today. I'll catch up with you tomorrow.

 

Good morrning Bubba,
I was a bit tired last night so I'll explain in more detail what happened.
I deleted as instructed and rebooted to see where still there.
HKEY/LOCAL MACHINE/MRU BLASTER/Cookieblaster &
HKEY/LOCAL MACHINE/MICROSOFT/WINDOWS/CURRENTVERSION/RUNONCE shows: C:\program files\MRU Blaster\indexcleaner.exe.-COOKIES
There is no sign of Temporary Internet files anywhere?!
A new developement is that the MRUB scheduler comes up when I start now with "Scheduling disabled".
My firewall allows MRU Blaster v1.5 and scheduler access to trusted & internet but not Server.

Hope this helps.

P.S. I'm going to try the whole proceedure again after I post this.

 

Tried again but the items are restored on reboot.
Also went to plugins TIF's selected "save settings + run now" and checked the registry but TIF don't show up anywhere.

 

Since it is important that I not mis-understand....are you saying that when you remove the below items in bold and then re-boot....those entries are still present right after re-boot ?

If that is the case We are back to where I was in my first post....it's either a user rights problem or one of your programs is preventing action happening to the HKLM hive which requires Admin rights. Until you can isolate which of your programs is preventing this....discussing MRUblaster is mute.

I would suggest you attempt to disable all of your Security\Privacy programs even if it means disconnecting from the Interent and disabling your firewall. If you do not know which of your programs monitors the registry....removing them from the equation is the only way. Until you can succesfully remove those above entries I mentioned with one of your programs placing them back in there....then it is useless to find out if MRUblaster is doing something wrong.

Hopefully others can assist you but I will be off line for a day or so....so good luck.

Bubba

 

Hello Bubba, I'll leave this for whenever you come back on line.

I have made a minor improvement. Found "Smit rem" which also uses HKEY Local Machine/Software/Microsoft/Windows/Current Version/runOnce. It was picked up in a scan by Panda Active Scan and I deleted it. Now when I remove the items in your last post 30 November 06. and reboot they are not present. However when I go to plugins and click TIF's save settings + run now only the Cookies and scheduler are present in the registry.

I did shut down everything and disconnected from the Internet but its just the same. Panda active scan warned about "SpywareQuake" but I can't find it in the registry or on the hijackthis scan unless its hiding under numbers and not name.

Keystagegolf.

 

If Panda is correct about SpywareQuake or you suspect malware infiltration taking into account the legitimate Smit rem cleaning tool already installed....you need to take care of this possible Smitfraud infection before concerning ourselves any further about MRUblaster. Your machine including all user accounts need to be checked by a malware expert.

Having said that and since Wilders no longer processes HJT logs as per this Announcement thread....I suggest you visit one of the sites contained in that announcement or one of the links below....

http://gladiator-antivirus.com/forum/index.php?showtopic=10517

http://www.dslreports.com/faq/13616

they give very good assistance with HJT analysis also. Please do follow all of their posting instructions and keep in mind it may take a bit to get thru the assistance so do find a time when you can stick with them fully until you are clean.

Once that is done and only when that is done will We be able to continue with this possible MRUblaster problem. Please supply the link to the thread where a malware expert is assisting you with your possible malware infection for follow-up by person.

Regards,
Bubba

http://www.bleepingcomputer.com/forums/topic73953.html

 

Hello Bubba,

Well I have a completely clean PC thanks to the help of Calamity Jane at the Broadband forum that you recommended.
However the MRU Blaster still does not put a key in the registry to delete TIF's. Is there anything else you can advise??

Could the problem be with IE7 compatibility? Do you have contact with the programmer at javacoolsoftware their web site does not list MRU Blaster!?

Regards

Keystagegolf

 

That is good to hear and without assuming wrongly....is this the thread where CJ helped you ?

At the moment no....but will await your answer of the above question and if that is you....I want to take a closer look at a few items you posted.

Speaking of only my installation of IE7....I have no problems with any software including MRUblaster.

As a side note from something you said earlier....

That in itself makes my head hurt in trying to narrow it down because MRUblaster does not just correct itself. MRUblaster clearly works but something(3rd party program installed) is preventing it from working all the time or there is possibly some confusion on your part in regards to using MRUblaster for more than one user and I'll ask that you Please review post # 21 above.

Also....I will also ask that you go to each of the below registry locations....highlight the entries one at a time....right click an entry....select Permissions and tell me what the settings are for Full Control and Read Please.

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster

Bubba

 

Hello Bubba,
Yes you are correct about the thread with Calamity Jane.

Here are the answers to your second question:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. Full control is checked & Read is checked.


HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster Full control is checked &
Read is checked.

Although two users have admin rights only I am using the MRU Blaster, at least until it is working OK. There is no conflict that one is countering the others actions.


If it in interesting when I right click the key on runonce the value Modify comes up clicked it brings up Edit string-valuedata then C:\program files\MRU BLaster\indexcleaner.exe - cookies.
I have not changed anything.

 

Well hopefully before the year is out We can at least get it working properly on your account login

Having said that....I will ask that you have patience as I ask that We start all over with this process by attempting to remove everything related to MRUblaster in the registry and file system. If successful We will then start all over with an install for your account login only.

1) Un-install MRUblaster via Add/Remove programs and reboot.
2) Go to the below registry keys\file system locations and delete any left over entries that are in bold....there will be some. After removal of those below items re-boot and after re-boot carefully check that no registry keys or file system locations are still there. If there are entries left....Please post about that before We go any further.

delete:
registry key entries

• HKEY_CURRENT_USER\Software\MRU-Blaster
• HKEY_LOCAL_MACHINE\SOFTWARE\MRU-Blaster
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce....any MRUblaster entry

file system entries

• C:\Program Files\MRU-Blaster
• C:\Documents and Settings\All Users\Start Menu\Programs\MRU-Blaster
• C:\Documents and Settings\~user~\Start Menu\Programs\Startup....look in every user folder including All Users and remove any MRU-Blaster entries

3) Re-boot and after re-boot carefully check that no registry keys or file system locations are present.
4) Log off your account that We have been working on and l log into the other accounts and delete any of the above mentioned registry key entries that you may find.

Bubba

 

OK Bubba, we are completely free of MRU Blaster. Out of interest I used the start/search and it found an entry MRU Blaster.(numbers that I ommited to note down) and it is also deleted. Have rebooted and its clean.
Over to you again.
Regards