I'm at a loss about this one. I installed the latest Real Player Gold (10?) and then uninstalled it thru the Control Panel. Then I deleted folders and ran a couple of registry cleaning programs to get rid of the rest. Then I rebooted. That was yesterday.
Since then, at startup and every minute or two, WinPatrol Alert gives me the new auto Startup Program alert for realsched.exe (which goes along with TkBell), followed by an instruction page (not helpful) in my browser. Here's what I've done:
- I've searched registry entries and files for these and Real Player with two or three registry editing and file management programs and deleted everything, including from Startup (msconfig), but at least one TkBell/"C:\Programs\Common Files\realsched.exe - osboot" entry keeps replacing itself in both the registry and startup.*
- I tried renaming the files, then dropping the file names entirely, as well as deleting just the data entries, but the entries keep coming back (located in HKLM\Software\Microsoft\Windows\Current Version\Run and startup).
- I've tried both of these steps several times with immediate restarts in between, but nothing works. That suggests there's something else left which is generating the problem, but darn if I know what it is.
I know these are harmless entries in the malware sense, but there's no reason (other than Real Player's bad will) that these should still be around. If anyone has an idea that sounds like something I haven't tried, I'd be grateful to hear it. This is a single user XP/SP3 system.
* There are three registry entries in binary that have realsched.exe, but finding the realsched.exe sequence is too difficult with regedit. They are located in HKLM\SYSTEM\CurrentControlSet (and ContrlSet002 and 006) \Control\SessionManager\AppCompatibility. I've deleted them from RegSeeker and they come back every time.
