# Computer Q: "Register Hack" from Spyware and how to fix it? **URL:** \ **Category:** Factual Questions\ **Created:** [August 24, 2005, 1:25am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363 "2005-08-24T01:25:28Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [August 24, 2005, 1:25am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/1 "2005-08-24T01:25:28Z")
Well, over the past few months, I’ve been getting this error message from my machine that says, “Cannot find PoptheBubbles2.exe. Please locate the file and try again. . .” or something to that effect. Basically, something, _somewhere_ is trying to run this program (which I can only assume is more spyware), and I don’t know what it is or does. I want it gone. I’ve tried running AdAware 6.0 and SE. I’ve tried SpyBot. I’ve tried Norton Antivirus, and a couple of other anti-Spyware programs. None of 'em. I even tried turning the lights down low, lighting a few candles, and played a little Barry White. Nothing. Well, every couple of hours this error message will pop up to my annoyance. I asked a couple of people about it, and they mentioned it might be a “registry hack” and that I just need to go in, do a search for that filename, and delete the reference. “Either that, or replace the ‘dll’ file.”. 😕 I am not _that_ good with a computer, so I’m a little confused. How to I get into the right registry (is there more than one?), or how do I find the right \*.dll file? I’ve opened my registry keys folder, and didn’t find anything. I even did a “regedit” at the DOS prompt, but didn’t find anything. What have I missed, or what am I doing wrong? Tripler Insert ubiquitous “turning the computer on” joke here. ---
**Author:** ![Shagnasty](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@Shagnasty](https://boards.straightdope.com/u/Shagnasty)\ **Post date:** [August 24, 2005, 1:37am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/2 "2005-08-24T01:37:48Z")
What they are telling you to do is: Go to Start — Run Type in Regedit In the Registry Editor, choose Edit ---- Find Type PoptheBubbles2.exe and hit Find Next If the search returns anything, then look at at right-hand side and remove that key. I don’t know of an easy way to describe how to mess with the .dll’s. ---
**Author:** ![Mr.Blue\_Sky](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Mr.Blue\_Sky](https://boards.straightdope.com/u/Mr.Blue_Sky)\ **Post date:** [August 24, 2005, 1:43am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/3 "2005-08-24T01:43:11Z")
To be on the safe side, though, export the registry _before_ you make any edits. ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [August 24, 2005, 1:45am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/4 "2005-08-24T01:45:43Z")
> [@Shagnasty](#): > > What they are telling you to do is: > > Go to Start — Run > Type in Regedit > In the Registry Editor, choose Edit ---- Find > Type PoptheBubbles2.exe and hit Find Next > If the search returns anything, then look at at right-hand side and remove that key. I tried that, but it didn’t find anything at all. Nothing. ☹ Tripler Anyone know what a \*.dll file is and how to search 'em? ---
**Author:** ![Mr.Blue\_Sky](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Mr.Blue\_Sky](https://boards.straightdope.com/u/Mr.Blue_Sky)\ **Post date:** [August 24, 2005, 1:51am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/5 "2005-08-24T01:51:33Z")
> [@Tripler](#): > > I tried that, but it didn’t find anything at all. Nothing. ☹ > > Tripler > Anyone know what a \*.dll file is and how to search 'em? The .dlls should be located in the Windows folder. Also, try using a wildcard to search the registry - pop\*, for example. ---
**Author:** ![Toddly](https://avatars.discourse-cdn.com/v4/letter/t/22d042/32.png) [@Toddly](https://boards.straightdope.com/u/Toddly)\ **Post date:** [August 24, 2005, 2:04am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/6 "2005-08-24T02:04:27Z")
It may be in your Startup program group. Go To Start \> Run \> type msconfig. Open the Startup tab to the far right side to see if the program is in that group. Uncheck the box if it is in there. I have also had good success with [RegCleaner](http://www.worldstart.com/weekly-download/archives/reg-cleaner4.3.htm) at cleaning out registry junk. You might try it. ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [August 24, 2005, 2:07am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/7 "2005-08-24T02:07:57Z")
Did you check Msconfig? [ol] [li]Click on “Start,” then “Run.”[/li][li]Type “msconfig” and click OK.[/li][li]Click on the startup tab.[/li][li]Look for the filename.[/li][li]If it’s there, uncheck the box next to it.[/li][li]Close MSConfig.[/li][/ol] You will be asked to restart. You’ll get a warning when you restart; tell it not to tell you again. If that doesn’t help, the best tool is Hijackthis. See if there’s an entry for “popthebubbles.exe.” If you see it, delete it. ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [August 24, 2005, 2:19am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/8 "2005-08-24T02:19:16Z")
> [@RealityChuck](#): > > Did you check Msconfig? > > [ol] > [li]Click on “Start,” then “Run.”[/li][li]Type “msconfig” and click OK.[/li][li]Click on the startup tab.[/li][li]Look for the filename.[/li][li]If it’s there, uncheck the box next to it.[/li][li]Close MSConfig.[/li][/ol] > > You will be asked to restart. You’ll get a warning when you restart; tell it not to tell you again. Well, I did that, but to no avail. I did find a few things that are kinda interesting (read: stuff I don’t think I own or deal with). Is it okay to uncheck things randomly? Tripler 😕 ---
**Author:** ![Mr.Blue\_Sky](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Mr.Blue\_Sky](https://boards.straightdope.com/u/Mr.Blue_Sky)\ **Post date:** [August 24, 2005, 2:35am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/9 "2005-08-24T02:35:27Z")
> [@Tripler](#): > > Well, I did that, but to no avail. I did find a few things that are kinda interesting (read: stuff I don’t think I own or deal with). Is it okay to uncheck things randomly? > > Tripler > 😕 Uncheck one thing at a time to see what effect it has on your system. If something bad happens, re-check it and try something else. ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [August 24, 2005, 4:39am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/10 "2005-08-24T04:39:09Z")
Damnit!! I ran SpySweeper to no avail. _Nothing!_ Nothing so far as to what I’ve tried and to what you guys have suggested have worked. It’s gotta be somewhere in my hard drive. What am I looking for?!?! Tripler Yeah, you know I’m getting angry! ---
**Author:** ![DougC](https://avatars.discourse-cdn.com/v4/letter/d/7feea3/32.png) [@DougC](https://boards.straightdope.com/u/DougC)\ **Post date:** [August 24, 2005, 4:55am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/11 "2005-08-24T04:55:58Z")
- - - **popthebubbles2.exe** appears to be just a regular game, not anything immediately associated with spyware. Most pages Google finds seem to associate it with the Intel PocketPC Camera: [http://www.google.com/search?num=30&hl=en&lr=&safe=off&c2coff=1&q=popthebubbles2\*&btnG=Search](http://www.google.com/search?num=30&hl=en&lr=&safe=off&c2coff=1&q=popthebubbles2*&btnG=Search) - Particularly here: [http://support.intel.com/support/createshare/camerapack/v4/pocket/sb/CS-016486.htm](http://support.intel.com/support/createshare/camerapack/v4/pocket/sb/CS-016486.htm) … As to what’s trying to load the games I don’t know, but it does not appear to be malware. Do you own one of these cameras, or was one ever connected to the PC (so that drivers would have been installed or loaded)? ~ ---
**Author:** ![DougC](https://avatars.discourse-cdn.com/v4/letter/d/7feea3/32.png) [@DougC](https://boards.straightdope.com/u/DougC)\ **Post date:** [August 24, 2005, 5:16am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/12 "2005-08-24T05:16:13Z")
- - - …Or, maybe some other webcam drivers/software. Here’s a page that says it came with the Logitech Quickcam Pro 3000… [http://xbitlabs.dealtime.com/xPR-Logitech\_Quickcam\_Pro\_3000~RD-83996872324](http://xbitlabs.dealtime.com/xPR-Logitech_Quickcam_Pro_3000~RD-83996872324) -So it appears as though it may have come with a camera or webcam bundle. ~ ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [August 24, 2005, 2:52pm UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/13 "2005-08-24T14:52:13Z")
**DougC** , Actually, I do/did have two of the possible culprits on my machine: [ul] [li]I currently have a PocketPC PDA - HP Jornada [/li][li]I had a Logitech camera for general use - now disconnected[/li][/ul] Since I’ve had the PDA for longer, and this seems to be more a recent problem, I betcha it is from that damned camera. Let me do a little more digging around my hard drive. . . Thanks for that one! Tripler I could have _sworn_ I did a Google search already . . . ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [August 25, 2005, 1:26am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/14 "2005-08-25T01:26:08Z")
See if you can find it with [Autoruns](http://www.sysinternals.com/utilities/autoruns.html). ---
**Author:** ![Tripler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripler/32/21807_2.png) [@Tripler](https://boards.straightdope.com/u/Tripler)\ **Post date:** [August 29, 2005, 2:22am UTC](https://boards.straightdope.com/t/computer-q-register-hack-from-spyware-and-how-to-fix-it/318363/15 "2005-08-29T02:22:46Z")
> [@yoyodyne](#): > > See if you can find it with [Autoruns](http://www.sysinternals.com/utilities/autoruns.html). By Jove, that found it! 😃 😃 😃 Now, I’ll leave my machine on all night to see if it comes up again. Apparently, it was some sort of automatic screen saver meant to pop up at some certain length of time. Tripler **yoyodyne** , if this works, I’ll owe you beer.