Shoutbox

Oh you have NO IDEA what a bitch this is to get rid of............

Summary:
The two files MSNLOGM.EXE and MSNLOGS.EXE install themselves so they start almost immediately on bootup, and theres a third process  (which i haven't tracked ) that restarts the processes if you stop them. What i have found is that various versions of this use 16 different file names and 13 different paths to reside in - my version didn't have MSAPPS.EXE, the restarter and recopier, which is why i couldn't find it.

Also, you may be interested to know i acquired my copy from MSN Polygamy 7.5, downloaded from the www.mess.be website ('Mess with Messenger'..... yeah, while it screws your PC up...)

Because the processes are in use you cannot delete them to get rid of them, and uninstalling MSN Content Plus leaves them on.

The Definitive way to get rid:
Theres  only one way - you have to boot the PC up without booting off windows, that way you can delete them.

The preferred way is to go to http://www.nu2.nu/pebuilder/ and download BART PE. This program, once installed will burn a CD. Put the CD in the CD drive , and reboot. The PC will boot into a version of Windows, but with the CD drive as the boot drive and called X:. You can then use the browser to browse to C: and delete the files - this CD will read NTFS partitions as well.

However, some PC's, like some DELL's and ACERS will blue screen trying to boot off this CD, so you other option is to find a copy of Norton Ghost Vsn 7.0, and use it to create a bootable CD.  Ghost 7.x is practically abandonware by now, so you might have to torrent for it.

This will enable you to boot to DOS off the CD drive, and then quit to the A: prompt. Now the snag here is that if the C is an NTFS then you wont be able to read it, since you cant read NTFS partitions in  DOS , so before you do this, you have to find a copy of Partition Magic 8 and convert the NTFS C: drive to FAT 32 to make it readable in DOS.

Its possible you will get an error 1681, in which case do this :

http://service1.symantec.com/SUPPORT/powerquest.n...8388256e8d006a841e

Then once its FAT 32, boot with the Ghost CD, drop to dos, and delete.

If your PC still has a floppy, and is FAT 32, then you can go to http://www.bootdisk.com/ and get an image of a DOS boot floppy , make a floppy from it and boot from that.

I know your all thinking WTF!! but this is how hard the annoying insidious program is to get rid of.

Aftermath;
Once you have got rid, make two dummy files with the same names,  (just make a text file and rename them), save copies into /windows and /windows/system32 and then make them read only, and that should stop the nasty little piece of shite ever installing itself ever again.

BTW, i searched the net for a guide as definitive as this in regards getting rid , there isnt one. Well, that  is to say, there is one now.

quote:

---

Originally posted by OldFartUK
The preferred way is to go to http://www.nu2.nu/pebuilder/ and download BART PE.
<snip>

---

....Or just boot into Safe Mode, and then search for and delete the files. Also, there are plenty of programs out there to help you find out what programs run on startup and let you remove entries (such as msconfig), meaning you don't have to have pointless dummy files on your hard drive either.

I haven't personally ever used the program so don't have this problem, but to be honest, your method makes things way too complicated. Also, there have already been solutions posted in this thread which have been shown to work...

Ah well, the dummy files were there to see if anything else happens, also, if you make them read only, it stops you getting them again (cos it cant overwrite them). Booting into safe mode doesnt work, because it still fires them up, and locks them for delete, because i've found the registry key thats firing them up -

In HKLM\software\microsoft\windows\currentversion\run theres a key called MSNSYSLOG with the value C:\windows\msnlogm.exe

Im too far down the solution to test this, but i suspect if you delete that registry key then reboot that will have the same kiss of death to the popup.

The problem with safe mode is your still firing up windows, if you want total freedom to frig about with it and not hit files in use (and therefore locked), then your far and away better booting up this way.

**EDIT**

I reinfected a machine to test it. Seems i'm correct; if you first delete this registry key and reboot, you can delete the two files with no hassle.