Hey Everyone, I have a question:
For some reason, I have a "party poker" icon that is installed after every few restarts.
When I go into properties for the icon, the target type is "%SystemRoot%\system32\partypoker.ico. So I go to C:\WINDOWS\system32 and there is another party poker icon. I've deleted that and the original desktop icon. Hoping it will work. Has anyone else had this experience?

It is not there all the time. Its weird and annoying. I have tried Adaware, AOL Online scan,Spybot,Hijack This, Norton Anti Virus 2005, Symantec Online scan,Pest Patrol, and Housecall.Trendmicro Online scan. nothing detects it.
Does anyone else have any ideas?
Thank You in Advance.

Pete

A Google search turned up lots of info...

You don't by any chance have messenger plus installed do you?

Hey Again everyone,

Wouldn't ya know it... I turn my computer on this morning and tada, there it is. Partypoker.com icon staring right back at me.
Jennifer and Dog, thanks for your responses.
Jennifer, I have done multiple searches, (yahoo, google, on here...) perhaps Im not searching for the right thing? Any ideas?
Dog, who exactly is messenger plus by? There are tons of stand alone messengers on here... yahoo, aim, MSN, ICQ lite...

Just for fun I tried CWShredder this morning. It didnt find anything.
Any other ideas anyone?
Thanks as always.

Pete

Uninstall "Party Poker" using Add/Remove Programs. Any remnants will be in C:\Program Files\PartyPoker

You asked what Messenger Plus was

http://inetexplorer.mvps.org/answers/43.html

Decide for yourself, but personally I think its a load of crapware.

Thanks Rambler and Dog,

Unfortunately There was nothing listed for Party Poker in program files. I did find, however, an executable called "rpaxnh.exe" in system 32. I couldn't find any information on it via searches, and since it came up as a BHO on my Hijack This scan, I deleted it and redid all the scans in safe mode. I'm not sure if that was the cause, but there have been 3 restarts since and no party poker icon or neededware popups yet. It may have fixed one or the other.. We shall see.

I have this same problem only im having less luck. I searched "rpaxnh.exe" and found nothing. plz someone help me get rid of this garbage!

www.slideimplied.tz4.com

also, i forgot to mention i have used adaware and microsoft anti-spyware and i have not had any luck. It simply will not go away. Ive deleted the file in the system 32 folder but it just keeps coming back. It does not show on the add/remove programs list either.

www.slideimplied.tz4.com

k guys i think i know the probelm i also have had this problem however i know one thing that so far thats eluded everyone else the only time ive had this problem with party poker is when i had downloaded microsoft anto spy ware remove all of anti spyware and see if that helps

I was told to try spybot, that didn't work either.
I am so lost with this I get it off my desktop and out of the system 32 folder and come back and it's back there. Or when doing something like writing an email my computer starts running and I keep having to click back to my email and there it is on my desktop.
This is so frustrating.

Run regedit. HKey_Local_machine\software\microsoft\windows\current version\run

delete registry entries that look like this.

SM_Gameshome

hope this helps

bennyhill, i tryed to do what you said but found no sm_gameshome of any sort. after i clicked on HKEY_local_machine\software\microsoft\currentversion\run, all that came up was optional components...there was however three things in optional components...IMAIL,MAPI,MSFS but nothing like sm_gameshome. I did see something called smDen in the current version folder but i didnt delete it. do i need to?? help

www.slideimplied.tz4.com

I have this also. I have firewall, and antivirus. I go to "find" type in poker. I delete all that comes up and then empty recycle bin. I also type in "vintage" since it seems to come up there to. I deleted all that. Party Poker still comes up every time I turn on computer. It is not in add/remove programs so can't be removed. Have "partypoker" blocked and it still shows up. It is a legit website for gambling. I think it is some unlegit affiliates getting in somehow.

I just went to "find" again to "files or folders" typed in "Merch" and up came 89 things. I deleted them all. Then emptied recycle bin. Seems it comes from either merchant collectibles, nike collectibles, harry potter, etc. I'll follow up later if this got rid of it.

Are you getting a virus when you scan your antivirus? I get this same virus show every few days, clean it, delete it and it comes back and party poker never goes away. Have run AIMFIX, SPYBOT, AdAware, my antivirus. Nothing is getting it off, I delete off desktop and out of systems 32 files and it comes back at least 4 times a day. It reloaded just now after I had run a scan to delete the virus and had removed and deleted the icon from desktop and the systems 32 folder
C:\WINDOWS\System32\rgkqkdndw30104lib.dll
Virus Name: Win32.Lastad.F trojan

I have party poker too, dont know how i got it, have tried all the things in posts.The worse is when your typing email you lose you mark, I have noticed "that" only happens when you delete party poker. I am ready to format the hard drive,as i hate to do that, I did it in December , maybe its time again. I think i spend more time doing virus scans,malware, ect. then getting anything done. Can I sue party poker for mental stress ?

I wish!! It's a pain isn't it. Same happens to me with being taken off what I am working on.

Hello everyone, I too, have been afflicted with this pain in the royal ass program, party poker. I have done every single thing you have, have downloaded anti-spy, ad aware, spypot, hijack this, etc etc, and even got my IT dept. involved here at work. It is on my home PC AND my work PC!!! Somehow, I got this thing, and I thought I always played it safe avoiding questionable websites. After three days of trying to rid myself of this thing, my IT dept. found three trojan worms, removed them, and now our last resort? Reformat the damn thing. That may be our only hope. Good luck to all of you!!! We should sue Party poker for mental anguish!!!!!

is it at all connected to the zbfreno application hiding in system32?

I found out how I was so lucky to get it. It came through AOL instant message. Is anyone else getting Explorer pop ups too? I havent had those for a long time. My spybot scan stops because of some german error, if its not one thing its something else. I remember when the internet was fun.

While typing this I had to reclick numerous times b/c guess what??? Yep!! Party icon was downloading AGAIN!!!

I suspect we will all have to erase our drives and reformat, which takes forever to really be rid of this.

But worries me that we might not get rid of it, I would so rather remove it and THEN do that.

Still no one has the answer tho, eh??

I also had party poker icon on my desktop. I went into my system restore and restored my computer to 8 days ago right before this icon first appeared on my computer. I did this yesterday and I have not seen the icon since.

tanner did you just try to delete it again?
that problem of losing your spot typing, stopped for me after a couple hours of not deleting the son of a b....
If you do a full format hard drive,then everything will be gone. every key stroke really. I hope it doesnt come to that. then again most likely I will be in the same spot a few months down the road,it seems you just cant keep this crap off your computer .

Thanks Mario, I hope not too, but I did verify it came from dang AOL AIM Messenger.

And Kellycat, I tried to restore, was able to restore back just a few days, wouldn't restore back to the point I had wanted.

Sounds like lucky me will be reformatting again soon, UGH.

i would HATE to reformat my HD being that i just did so a month ago!! what luck!! geez. i think for now im going to try system restore and hope for the best.

www.slideimplied.tz4.com

i restored back to may 25th and when windows booted back up i went to system 32 to check and guess what was still there! im going to restore even further back later on. hope that does it.

www.slideimplied.tz4.com

tried that too, restoring, isn't taking care of it.

I'm having the same problem, how do we know that AOL instant messenger is the problem?

because usually you recieve a message from a friend on your buddy list that has a link , usually says something like this is you or reminds me of you.. i didn't even open it, i right click to see where the link went and got it that way. man once you have it its nearly impossible to get off, i just ran mcafee and found a worm as well as a trojan it dlwed.

I'm not sure how legit this partypoker.com is. I do know that there is a partypoker.net.
I don't even want to go to partypoker.com, but I'd imagine it's real.
Anyone else having any luck?
I find it hard to believe that of all the people on the internet and forums like this, no one has had this problem and found a resolution.
Ugh.

http://www.geekstogo.com/forum/
in there you will find a free program spysubtract- free download, it found party poker and deleted it. now just waiting to see if it comes back.

YES GOOD NEWS EVERYBODY! THERE IS HOPE!!! after that system restore it hasnt come back!!!!!!!!! yay! good luck to all of you, but try system restore.

www.slideimplied.tz4.com

look for www.neededware - this is what i think it is really called, it will go in your explorer internet settings as a trusted site.

I agree with Mario. At the same time as the Party Poker I had neededware. Somehow it would show up as a "trusted site". To check go to Internet Explorer, and then Tools/Internet options/Security. Then click on trusted sites.
I have gotten rid of anything relating to neededware and Party Poker has been gone. Try this site:
http://securityresponse.symantec.com/avcenter/venc/data/adware.neededware.html

Post the results.
Good luck!
Pete

like i said a day ago, i got rid of party poker but what happens today??? no not party poker but another casio BS program. BUT lucky for me and you, Pete has solved the problem so thank you very very very very very very much...your the man.

www.slideimplied.tz4.com

well, ive pretty much given up i mean this is ridiculous. How can these places do this to our computers? How can they invade our privacy like this? I hope all these places get sued. Im fed up with trying and searching to get rid of something i didnt even ask to be on my computer. Good luck to all of you. I feel your pain.

www.slideimplied.tz4.com

I have been dealing with this problem for a couple of weeks. My McAfee AV doesn't detect it, but the firewall blocks it only to have it come back the next time I sign on & it has a new ".exe" name file. AOL spyware doesn't detect it & spybot finds & deletes it but it returns when I sign on. I used Symantec Virus Scan & found 7 infected files:

C:/Windows/System/kdqsrz.exe
/WinStat10.dll /epx30104.exe /WinStat11.dll /xjhv.exe /aqu.exe
C:/Program Files/Windows Media Player/WMPLAYER.EXE

But I have not been successfull using the Symantec removal suggestions because I can't find them in my registry.

I contacted McAfee & they told me to download stinger, but it has not found it either.

I went to WWW.eicar.com & ran the Anti-Virus tester. My firewall does detect the tester virus but it does not clean, Quarentine, nor delete it. When I run anti-virus it does not detect it. Anyone one come up with a solution yet?

I am now getting the poker.com file as casino.com & blackjack.

AGotha

Oh my gosh, I've been dealing with this for a few weeks as well, I got rid of the icon by blocking www.neededware.com but I'm still getting popups!
I've tried Symantic and adaware, Spybot is the only program that found something. It found a few registry changes and a ton of files..But it keeps coming back even after I clean it!! UGH!!!
I have windows 2000 I can't do that cool restore thing that XP has :(

Well I do believe taking care of neededware.com got rid of it. After I updated my Norton Anti Virus (2005) it finally detected it and I have not had the icon or any popups since. All you have to do is search for "neededware.com" on any trusty search engine and many sites to take care of the problem will come up. Feel free to post results to help everyone else...

Something that might work, might not.

I was afflicted by this ParkyPoker garbage, running Windows XP. Somehow, I managed to stop it from appearing, but then a phantom IE window kept popping up. Like, there was an IEXPLORE.EXE process running, taking up varying amounts of memory space, 15-18K, but no window would appear anywhere on the desktop, even in the Applications list. I would kill the process, and the proceess tree, but it would keep reappearing every few minutes. Whatever window I was working in when it ran itself was set to inactive. Webroot SpySweeper traced it to an executable, "wgfstz.exe" in C:\Windows\System32. There was a similar DLL file as well, "wgfstzaeg05.dll." They were both protected and wouldn't let me delete it. Searches on Google, Microsoft, Yahoo, and Symantec turned up NOTHING for either of the files. When I tried to wipe it from the registry, it kept putting itself right back in, and I was just deleting it over and over again. I finally booted into Safe Mode with Command Prompt and killed the files in DOS for good.

Neither PartyPoker nor the mysterious IEXPLORE.EXE process have been back since.

Search your systems for these files. If you have them, kill them through DOS and then in the Registry.

I never get the icon on the desktop (except once, and deleted it then), but I continuosly get the pop ups. None of what you guys say work. There were no wgfstz.exe or wgfstzaeg05.dll files. But I do remember seeing IEXPLORE.EXE alot. I just thought that had something to do with Internet Explorer. Searching for IEXPLORE.EXE came up with 4 searches. I'm almost afraid to delete them, just in case they turn out to be something I really need. But one did show up with the word '$NtServicePackUninstall$' in it. I figured anything with $ signs, has to be Party Poker. I hope I won't regret deleteing these...