quick player and windows media

[Tarq57]

Please close HJT, reboot, and then run another scan (as admin again, please) and post a log. (Perform a scan and save a logfile, the top button.)

You might be out of the woods; we'll see. Still a few more things to do. Hopefully straightforward.

(PS, if you see any text in my replies that looks like this put the mouse over it for a full view.)

[sham1313]

short note 1st I well hoover my mouse If I if I see what you mention. next the log

[sham1313]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:59:08 PM, on 5/6/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\TechTracker\VersionTracker Pro\VersionTrackerPro.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Opera\opera.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 64.136.44.66;64.136.52.66;64.136.52.70;searchap.untd.com;127.0.0.1;localhost;*microsoft.com;*windowsupdate.com;*wustat.windows.com;*.pogo.com;*test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.networkassociates.com;*.dir.untd.com;cf.netzero.net;qs.netzero.net;*.aolcdn.com;*.quicken.com;<local>;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: VersionTrackerPro.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: *.mybluelight.com
O15 - Trusted Zone: *.mybluelight.net
O15 - Trusted Zone: *.netzero.com
O15 - Trusted Zone: *.netzero.net
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9cb4226c992a0) (gupdate1c9cb4226c992a0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - (no file)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8244 bytes

[sham1313]

I know back at the begining when we were talking about the media player and the quick play when I told you about the 3 icon the two that were called desktop and the other one was a java scrip error.  you said you did not know what was going on with them why they just apperd on my desktop and then the itune icon came on my desk top and now  there is a blue file looking icon that is just called desktop. I know the subject was drop right after I mention the 3 Icon at the begining, but with this last one just appering if that had any thing to do maybe with a virus or a winsdows vista problem.

[Tarq57]

We've just got a bit of tidying up to do now, possibly including those icons if that can be worked out.
One of the issues you have is an out of date Java, and in the next post or maybe the one after, I'll talk you through updating that. And that might make one those icons go away.
For now, though, lets just stick with what's being dealt with at the moment. Computers are very one-step-at-a-time type beasts, so we have to be methodical.

The good news is that the nasty malware is gone. You've nuked it. 

More info/instructions soon; just stepping out to do some atmospheric research.

[sham1313]

     that part is great news!!!  I do Thank you!! I am not sure when my husband will want to get on it can be from any time now till 8 or 9pm that is when he wants on for a while he collect certain things like puma knife and certain pocket watches. he like to come pare what he paid for it back when to what it is going for now. 8pm I guess is when they list the new items. the evening is the only time he can get on do to work. I am just glad I don't have to think when he is on that the virus might be getting worse. if he study the computer a tenth of what he does his collection he would be a computer wiz. You have been helping other people as well as me so if you need a big break I understand and well see you when I catch your next post. thanks Sharon

[Tarq57]

OK, can you look in "C:\Program files" please, and tell me if this folder exists

C:\Program Files\AntiVirus_Pro\

and if it does, delete it.
How much more time do you have? It's just after 1pm where I am.

[Tarq57]

PS, I don't need a big break; I enjoy doing this stuff. For all sorts of reasons. I'm learning too.

[sham1313]

as soon as I wrote that last post my husband got on the computer and just got off. most times he get on 8 or 9pm and stays on till 10 or ten thirty. I am not sure how many hours are between us. it is almost 8pm now.
         I see no antivirus pro file
I guess that 49.95 I paid for that so called virus scanner I am glad I got my money back and glad I found some like you that enjoys helping people with computer. that way some times I can get on the internet and do what I like to on here. {very big smile} Sharon I click on spelling check and it came up and error if it does it again I will write it down and send it.

[sham1313]

altho when I type antivirus pro in the search when you click I saw 4 item on this one I click onfile location and in appdata local opera profile images and found http%3A%2F%2Fwww.att.c... there were 3 other that had antivirus pro. nothing comes up when I type antivirus pro there now. the place these were at were many many different things there. Sharon

[sham1313]

see ya in the morning my time I think you time is later then it is here. I am on pacific stander time Sharon sham1313

[Tarq57]

OK, I'm going to assume that you found and deleted the folder I mentioned above.
If it didn't exist, it doesn't matter.
(If it could not be deleted, try rebooting into safe mode, then delete it.
If it still could not be deleted, do nothing further, and post back.
I think this is unlikely. It is likely the folder existed, and deleted OK.)

Info: If you hold the "ctrl" button down on the keyboard, and slowly rotate the mouse wheel, you can change the size of the print on a web page. Other graphics may not display correctly, however. Don't forget to put it back to roughly where it was when you've seen what you need to see.

 -Next.
Run HJT again (as admin) and do a system scan.
I recommend you place a tick beside the following entries:

02 BHO (no name) {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)


O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - (no file)

and only those entries, then scroll down and click "fix selected". This shouldn't take very long at all.
(These are "orphaned" entries for which no supporting program file exists.It's tidying up, really.)

Exit HijackThis.

 -Next, update Java.

  -There are two or three ways to update Java. It used to be a bit of a nightmare, but has improved considerably. I'll post one way, if you have problems or something doesn't work as it should, we'll try another method.
  -I recommend you download JavaRa -(direct download) by RaProducts. (info page). Save the file to your desktop. It is a zipped program. To use it unzip it (extract) to your desktop, (or to a folder you might choose to keep it in. You won't need to use it often.)
  -Open JavaRa by double clicking it. (red/yellow sun+blue background icon.)
Select "search for updates", and then select the recommended option, to go to the website. On the website page that opens are a number of downloads. Select the "Java SE Runtime Environment (JRE)". You'll be taken to another page, select  "windows" from the drop down menu, agree to the terms (if you do; I've only ever read them once. Didn't understand it then, either), and then click the link under the top one, Windows offline installation, and save the file to your desktop. It's about 15megs.
(JavaRa can be closed anytime; you'll need to open it again after Java is installed.)
  -Close your browser, then double click the saved file, and let it install.
  -Once it has installed, go here and hopefully it will look like the picture below.
  -Open JavaRa and have "remove older versions" This will take a few seconds. Afterward if you want to you can clear all the logfiles it created under "additional tasks".
(Note that when a task has been actioned in JavaRa you finish that particular item by clicking the red X, the sub-GUI will not automatically vanish, like you may be used to.)
  -Close JavaRa.

I think that will do for now. Still some more stuff to do, want to see how you go with that, first.

Regards, Tarq.

[sham1313]

I am not sure about holding the ctrl and  doing the rest of what you say to make the print bigger. I have a wireless left click and right click mouse and it does not rotate on a ball, but there is a place on this browser to make the print bigger or smaller but I do not think it would have made the print any bigger in side where the words were in hj program
       there was no antivirus pro folder in C: program file but when I typed antivirus pro in the search after I click start there were 4 item there when I right click and went to the file location there were 4 item that had to do with antivirus pro and sense you said if I found that folder to delete it I figure you want me to delete the 4 item I saw. they were not in a folder each one was by itself. I see you have more for me to start on and in the morning I well start that.
thanks Sharon

OK, I'm going to assume that you found and deleted the folder I mentioned above.
If it didn't exist, it doesn't matter.
(If it could not be deleted, try rebooting into safe mode, then delete it.
If it still could not be deleted, do nothing further, and post back.
I think this is unlikely. It is likely the folder existed, and deleted OK.)

Info: If you hold the "ctrl" button down on the keyboard, and slowly rotate the mouse wheel, you can change the size of the print on a web page. Other graphics may not display correctly, however. Don't forget to put it back to roughly where it was when you've seen what you need to see.

 -Next.
Run HJT again (as admin) and do a system scan.
I recommend you place a tick beside the following entries:

02 BHO (no name) {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)

O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)


O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - (no file)

and only those entries, then scroll down and click "fix selected". This shouldn't take very long at all.
(These are "orphaned" entries for which no supporting program file exists.It's tidying up, really.)

Exit HijackThis.

 -Next, update Java.

  -There are two or three ways to update Java. It used to be a bit of a nightmare, but has improved considerably. I'll post one way, if you have problems or something doesn't work as it should, we'll try another method.
  -I recommend you download JavaRa-direct download by RaProducts. (info page). Save the file to your desktop. It is a zipped program. To use it unzip it (extract) to your desktop, (or to a folder you might choose to keep it in. You won't need to use it often.)
  -Open JavaRa by double clicking it. (red/yellow sun+blue background icon.)
Select "search for updates", and then select the recommended option, to go to the website. On the website page that opens are a number of downloads. Select the "Java SE Runtime Environment (JRE)". You'll be taken to another page, select  "windows" from the drop down menu, agree to the terms (if you do; I've only ever read them once. Didn't understand it then, either), and then click the link under the top one, Windows offline installation, and save the file to your desktop. It's about 15megs.
(JavaRa can be closed anytime; you'll need to open it again after Java is installed.)
  -Close your browser, then double click the saved file, and let it install.
  -Once it has installed, go here and hopefully it will look like the picture below.
  -Open JavaRa and have "remove older versions" This will take a few seconds. Afterward if you want to you can clear all the logfiles it created under "additional tasks".
(Note that when a task has been actioned in JavaRa you finish that particular item by clicking the red X, the sub-GUI will not automatically vanish, like you may be used to.)
  -Close JavaRa.

I think that will do for now. Still some more stuff to do, want to see how you go with that, first.

Regards, Tarq.

[sham1313]

 -Next.
Run HJT again (as admin) and do a system scan.
I recommend you place a tick beside the following entries:
Quote


what do you mean by the above
thanks Sharon

[Tarq57]

-Next.
Run HJT again (as admin) and do a system scan.
I recommend you place a tick beside the following entries:
Quote


what do you mean by the above
thanks Sharon

Right click the HijackThis icon, select "run as" then "administrator".
Do a system scan.
At the completion of the scan, a list is displayed.
The items in that list will include the items I have quoted; they all come from your last scan.
Place a tick in the box beside each item (and only those items).
Scroll down (in the HjT panel) and locate the button that says "fix selected"
Push it.