OS is Win98SE
Computer in question is used by more than one person.


I have heard of Incredimail, but only from a friend that USES it for email. It sounded like just another email client. True?


A couple of days ago, an icon appeared on the desktop,
"Complete Incredimail Installation".

Deleted it. Crossed fingers.

It reappeared the next day.

One of the users of the computer is elderly. In her email, I found a forwarded email from another elderly friend, with mention of Incredimail, and a big ol' "Click here" button.
She uses a web interface for accessing email. Using IE v.6
No need to press and ask. I can make a reasonable assumption that it was clicked, and somehow it downloaded and installed an installation program.

I started looking around.

Found it in C:\Windows\Temp\ImInstaller\IncrediMail
An executable, a .cab file and a text file or two.

I have not deleted that stuff yet.

Because it reappears, I looked some more.
Rebooted, and there it was.... again.

Using the Search function in regedit, I found it a few times.


HKEY_LOCAL_MACHINE\Software\ImInstaller
name=IncrediMail_iver data={a hex number here}


HKEY_LOCAL_MACHINE\Software\ImInstaller\IncrediMail
name=Root
data=www5l.incredimail.com/contents/setup/2007032901/downloader_nu

name=ScriptUrl
data=www5l.incredimail.com/contents/setup/2007032901/downloader_nu/setupscript.xml



HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
zzz_ImInstaller_IncrediMail
C:\WINDOWS\TEMP\ImInstaller\IncrediMail\INCREDIMAIL_INSTALL[1].EXE -startup -product IncrediMail -cluster 2



Questions:

1.) What do you think happened?


2.) What would you do?
This is the bottom line, main question.
I am curious about some things while we are at it though.


3.) At first I thought it would be ok to delete the files in the temp dir .
Wouldn't that cause some sort of burp at boot time though? ... since
apparently the registry entries are looking for them.

4.) Would it be ok to delete those registry entries with regedit?
In other words, would the combination of deleting the files in the
temp dir and deleting those keys, be the proper fix?

5.) Other than politely advising not to click on things found in emails, is
there any other preventative action I can take?



Any and all comments/thought/ideas greatly appreciated.

Need more info regarding the system, ask and I'll get it.


Thanks





This may not answer every question you may have, but I hope you find it useful...I Googled it and found the following for complete removal. IncrediMail does not provide this info in their Support SECTION:

http://www.oeupdates.com/Uninstall-remove-IncrediMail.html


The above link also refers to a Microsoft KnowledgeBase document:

http://support.microsoft.com/default.aspx?scid=kb;en-us;297069


Good luck...Quote from: Saviour on April 09, 2007, 07:30:55 PM

This may not answer every question you may have, but I hope you find it useful...I Googled it and found the following for complete removal.

IncrediMail does not provide this info in their Support section:

http://www.oeupdates.com/Uninstall-remove-IncrediMail.html

The above link also refers to a Microsoft KnowledgeBase document:

http://support.microsoft.com/default.aspx?scid=kb;en-us;297069

You Googled Incredimail?

Quote

You Googled Incredimail?

Nope...I Googled "Completely Remove IncrediMail",

because I've run across this sort of problem before on someone else's computer.

I know you stated IncrediMail is not installed,

but it seems the Installer wants to run every time you boot.

IncrediMail's support page will only tell you how to uninstall it using Control Panel, but doesn't assist with the issue you seem to be experiencing.

Sorry I couldn't help. Good luck!

I suggest you follow your 4) above.

Also check msconfig for the starup entry.

Quote from: Saviour on April 10, 2007, 02:01:52 PM

Quote

You Googled Incredimail?

Nope...I Googled "Completely Remove IncrediMail",

This is not Incredimail. It is an installer for Incredimail.

Quote

because I've run across this sort of problem before on someone else's computer.

You have? Great!
But.... you forgot to describe what you did to fix it. ....or, you couldn't fix it?
.... or.... what?


Quote

I know you stated IncrediMail is not installed,

Right.

Quote

but it seems the Installer wants to run every time you boot.

Right.

Quote

IncrediMail's support page will only tell you how to uninstall it using Control Panel, but doesn't assist with the issue you seem to be experiencing.

Right.


Quote

Sorry I couldn't help. Good luck!

Ok.
Thanks for wishing me luck.

1) Delete the install files you found.

2) Delete the reg entries you listed.

3) Restart regedit (not the machine) and type incredimail in the search field...F3 takes you to the next listing until you reach the end of the registry.Delete any other incredimail keys that are found.

Re-boot and run CCleaner and you should be good to go...

To be perfectly honest...it was a while ago, when I happened upon this problem so, I can't remember in detail what it was I did (at that time) to remove it.

I realize IncrediMail is not installed and that it is the "Installer" that continually wants to run.

I hope you find the above information helpful and find a solution to removing the IncrediMail Installer from this computer.