Star Up Entry Help/Advice Needed?.

[bluesjunior]

I have used Orbit Downloader for some time now, and when I have updated it with each newer version I just installed it over the top of the older one. However this morning I was informed that there was a new update and so decided to uninstall the previous one and go for a clean re-install with the latest version. I used Revo Uninstaller at the highest level and uninstalled the version I had been using. This went fine and in fact there were no entries to delete with the Revo extended scan other than the normal one. I did see a pop up about RUNDL.32 and RunOnce but thought that it was a part of the uninstall process. I then deleted the entries from Comodo using the Purge button and ran a scan with CCleaner for leftovers which found none, While in CCleaner I had a look at my start up entries where I saw that I had a new entry a program called DeleteGrabPro. Now this wasn't there prior to uninstalling Orbit but as GrabPro is a part of Orbit I couldn't understand why it had not been deleted along with Orbit. I ran a scan with AutoRuns and found it in the Microsoft and Windows entries. Now I have always been wary of messing with MSN or Windows files and so am not sure what this program is and would it be safe to delete it?. I did a Google search on it but all the results had it listed an entry as part of a Hijack but not apparently any source of infection. Can anyone tell me what this is and is it safe or dangerous?. The full path is as follows: HKCU\..\RunOnce: [DeleteGrabPro] rundll32.exe advpack.dll,DelNodeRunDLL32 "C:\Program Files (x86)\Orbitdownloader\GrabPro.dll"

 

[Elmer BeFuddled]

Hi blues jr.
It's been set up, as it says, to "Run Once" so it deletes the GrabPro.dll file when it isn't loaded into the system.
If the GrabPro.dll is still in your program files, you can leave it to run once, check the GrabPro.dll has indeed gone and that the run once entry is no longer there (some do linger / reload) or you can try to manually delete the GrabPro.dll file and then remove the run once entry.

HTH