PAL Spyware Remover removal

[mauserme]

Does anyone know how to remove PAL Spyware Remover?

This is one of the rogue spyware programs on a computer I'm trying to clean up and I can't make it go away.  The un-installer is broken (or doesn't work on purpose) and the support link on the PAL web page is dead.

Can't find much about it with a Google search either.

[Spyros]

Try this: http://crystalidea.com/?action=show_page&name=utool

[mauserme]

Thanks Spyros.  That looks like a very useful tool.

I'll be out of town for a few days so will get back with the result after the weekend.

[DavidR]

CoffeeCup Spyware Remover       coffeecup.com       false positives work as goad to purchase; uses inadequate ref database (1); same app as Easy Spyware Killer, JC Spyware Remover & Adware Killer, & PAL Spyware Remover; Note: discontinued by vendor July 2005 [A: 7-27-04 / U: 12-8-05]

Easy Spyware Killer      easyspywarekiller.com      scant info on home page, no privacy policy (1); false positives work as goad to purchase; uses inadequate ref database (1);  same app as CoffeeCup Spyware Remover, PAL Spyware Remover, & JC Spyware Remover & Adware Killer [A: 6-26-04 / U: 6-26-04]

JC Spyware Remover &  Adware Killer       jcspyware-remover.com       false positives work as goad to purchase; uses inadequate ref database (1); same app as Easy Spyware Killer & PAL Spyware Remover [A: 6-26-04 / U: 6-26-04]

PAL Spyware Remover       palsol.com
palsol.biz
palsol.net     aggressive advertising, browser hijacking (1, 2, 3, 4); false positives work as goad to purchase; uses inadequate ref database (1); exploits name "spybot" (1); exploits name "spyware warrior" (1); same app as CoffeeCup Spyware Remover, Easy Spyware Killer, & JC Spyware Remover & Adware Killer - (Note: other domains associated w/ PAL Spyware Remover include: 1spyware-removal.com, adwarebgone.info, adwarespyware.net, cybergations.com, espywarekiller.privacyregained.com, free-spyware-scan.info, jointventureforprofit.com/spy/, online-spyware-scan.com, paltek.net, petspatrol.com, shmyl.com/ierison, spybot-scan.com, spybot-scanner.com, spybot-virus-scan.com, spybot.com-xp.com, spy-spyware.com, spyware1.com, spywarefinder.net, spywarekiller.us, spyware-remover-software.net, spywarescout.com, spywarethis.com-xp.com, spyware-virus-scan.com, spyware-virus-remover.com, trojan-virus-scan.com, win-fix.com) [A: 6-26-04 / U: 6-26-04]

As you can see this one comes with many aliases, so you may bump into it in other guises.

You could use hijackthis to find the location it is running from and delete the registry start-up entries, etc.

[mauserme]

Unfortunately the Uninstall Tool didn't work - I still get the missing data file error when I try to uninstall this (I wonder if this is the file you get if you purchase PAL).

@David

I was able to remove this from the start ups so its not running - just lurking.  And it doesn't show up in the hijackthis log.

At this point the disease is symptom free and I've given the computer back to its owner.  If there are any other ideas about how to remove it I'll have the computer back later this week to install some memory.  I'll look at the registry then but I'm concerned there might be some no-so-obvious components to this that editing the registry won't fix.

[polonus]

Hi mauserme,

Try this on this pop up bastard:

http://grc.com/files/shootthemessenger.exe

polonus

[mauserme]

Hi polonus,

The messenger has already been shot, so to speak, and whether its that or the fact that PAL is not actively running the pop ups are no longer occurring.  But I can't get the program to uninstall.  As I said, the disease is symptomless but still present.

If it was my computer I might feel comfortable leaving well enough alone, but I'm concerned somebody might click the executable out of curiosity.  I've changed the extension to .dat to discourage this but who knows.  It  can't be a good thing having this on the computer even if it's not active.

Its frustrating...

[DavidR]

If you are able to identify the program location based on your previous missing data file error and the start-ups entry you removed. You might have to see if there are any other references to that folder or other related folders. In the end if you identify the related folders you may have to delete them, or rename them if your not happy about deleting them.

[mauserme]

In the end if you identify the related folders you may have to delete them, or rename them if your not happy about deleting them.

I do know where the files are located, but don't I run the risk of causing additional problems if I just delete them??

[DavidR]

That is also why I said rename them, any reference/call to them would fail and hopefully throw up the warning missing file, etc. Hopefully you can then identify what is calling them if it is legit or otherwise. If after renaming them after a week or two and no adverse effect then it may be safe to delete them.

If you know where they are try a registry search for the known location and see if there are any other entries.

[polonus]

Hi mauserme,

Try the trial version of this program to uninstall this misnomer:
http://www.pcworld.com/downloads/file_download/fid,8087-order,1-page,1-c,alldownloads/download.html

polonus

[mauserme]

The AShampoo Uninstaller Suite was also unsuccessful in removing this problem.

On David's advice I moved the PAL files to another location but, having already renamed the exe without receiving any error notices, its not surprising to find an absence of errors after the move.

Although the support link on the PAL site is still dead their email seems to be OK - ie the email I sent has not been returned as undeliverable.  I'll post again if/when I get a response.

[mauserme]

Not a word from the people at PAL of course, so yesterday I copied the files to a CD, deleted them from the hard drive and let Eusing do the registry cleaning for me.  So far so good.

Thanks for the suggestion, David.

[DavidR]

Your welcome, after this time I doubt you will have any trouble, having removed any registry entries also.