[Ardant]

Ron,

Thank you for your assistance. This has to be one of the worst infections my kids have ever gotten. I would assume it came from a website download they did without my permission.

Is McAfee site adviser any good. I figure if they get a yellow or red screen they will hopefully not go there.

[Advertisements]

McAfee and I aren't friends so I hesitate to endorse anything of theirs. You might try the WOT add-on for firefox or better yet, uninstall MSSE and uninstall the free Avast. It's a really nice anti-virus and has a site checker. Plus it has a great boot-time scan which solves most malware problems and will block access to a site that tries to do something funny.

Download and Save the free Avast installer.
http://www.avast.com...ivirus-download

Uninstall Microsoft Security Essentials

Reboot

Install Avast by right clicking and Run As Admin. (Register when it asks you - they will try to talk you in to buying the full product but the free version is what we want.)

If you feel you need a firewall then the free Online Armor http://www.online-ar...-armor-free.php can be used with Avast.

If you try Avast: Some people object to the voice notification of updates. To turn it off, click on the Avast ball then on Settings. Then on Sounds and uncheck Automatic Updates OK. (It will still update it just won't tell you about in a loud voice in the middle of the night.)

They have also started using their info popup to try and get you to upgrade so I go into Settings, Popups and change the first two to 1 second.

The registration is good for 12-14 months then you will need to register again. They will, of course, try to talk you into buying the product but you can always register again for another year free tho it won't be the default option.


To use their boot-time scan: Click on the Avast ball. Then click on Scan Computer, then on
Boot-Time Scan then on Settings. Change the Ask at the bottom to Move to Chest. OK then Schedule Now. Reboot and let it run a scan. It may take hours.
Once it finishes it should load windows. Click on the Avast ball and then on Scan Logs, select the Boot-time scan report then View Results and it will tell you if it found anything. A text version of the report is at: C:\ProgramData\Avast Software\Avast\report\aswboot.txt

[RKinner]

McAfee and I aren't friends so I hesitate to endorse anything of theirs. You might try the WOT add-on for firefox or better yet, uninstall MSSE and uninstall the free Avast. It's a really nice anti-virus and has a site checker. Plus it has a great boot-time scan which solves most malware problems and will block access to a site that tries to do something funny.

Download and Save the free Avast installer.
http://www.avast.com...ivirus-download

Uninstall Microsoft Security Essentials

Reboot

Install Avast by right clicking and Run As Admin. (Register when it asks you - they will try to talk you in to buying the full product but the free version is what we want.)

If you feel you need a firewall then the free Online Armor http://www.online-ar...-armor-free.php can be used with Avast.

If you try Avast: Some people object to the voice notification of updates. To turn it off, click on the Avast ball then on Settings. Then on Sounds and uncheck Automatic Updates OK. (It will still update it just won't tell you about in a loud voice in the middle of the night.)

They have also started using their info popup to try and get you to upgrade so I go into Settings, Popups and change the first two to 1 second.

The registration is good for 12-14 months then you will need to register again. They will, of course, try to talk you into buying the product but you can always register again for another year free tho it won't be the default option.


To use their boot-time scan: Click on the Avast ball. Then click on Scan Computer, then on
Boot-Time Scan then on Settings. Change the Ask at the bottom to Move to Chest. OK then Schedule Now. Reboot and let it run a scan. It may take hours.
Once it finishes it should load windows. Click on the Avast ball and then on Scan Logs, select the Boot-time scan report then View Results and it will tell you if it found anything. A text version of the report is at: C:\ProgramData\Avast Software\Avast\report\aswboot.txt

[Ardant]

It took a while but I ran the boot scan. Results as follows

10/08/2012 13:29
Scan of all local drives

File C:\Users\Lindsay\Downloads\mp3rocket (1).exe|>$INSTDIR\tv10.zip|>tv.swf Error 42125 {ZIP archive is corrupted.}
File C:\Users\Lindsay\Downloads\mp3rocket (2).exe|>$INSTDIR\tv10.zip|>tv.swf Error 42125 {ZIP archive is corrupted.}
File C:\Users\Lindsay\Downloads\mp3rocket (3).exe|>$INSTDIR\tv10.zip|>tv.swf Error 42125 {ZIP archive is corrupted.}
File C:\Users\Lindsay\Downloads\mp3rocket (4).exe|>$INSTDIR\tv10.zip|>tv.swf Error 42125 {ZIP archive is corrupted.}
File C:\Users\Lindsay\Downloads\mp3rocket.exe|>$INSTDIR\tv10.zip|>tv.swf Error 42125 {ZIP archive is corrupted.}
File C:\Users\Summer Camp 2009\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\3f154490-47d755b2|>bpac\a$1.class is infected by Java:Agent-BJ [Expl], Moved to chest
Number of searched folders: 43115
Number of tested files: 1369570
Number of infected files: 1

[RKinner]

These files should be deleted. There is something wrong with them and trying to use them might do strange things to your PC.

C:\Users\Lindsay\Downloads\mp3rocket (1).exe
C:\Users\Lindsay\Downloads\mp3rocket (2).exe
C:\Users\Lindsay\Downloads\mp3rocket (3).exe
C:\Users\Lindsay\Downloads\mp3rocket (4).exe
C:\Users\Lindsay\Downloads\mp3rocket.exe

I would log in as Summer Camp 2009 and clear the java cache:

by following the instructions on
http://www.java.com/...lugin_cache.xml

Other than that it looks good.

[Ardant]

I have been trying to delete the Java Temp Files on the summercamp user but it keeps locking up.

Any thoughts?

[RKinner]

Uninstall Java then delete the folder:

C:\Users\Summer Camp 2009\AppData\LocalLow\Sun

It's a hidden system folder so you may need to:

Open the Control Panel menu and click Folder Options.
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and exit.
Now your computer is configured to show all hidden files.

[Ardant]

Ok done all that. I have gone and reinstalled Java from the website you gave me earlier.

I will monitor the system and see how it performs

[Ardant]

I have started getting messages saying USB Device not recognized.

I have gone into Control Panel/device manager and found 2 unknown USB devices. I disabled both rebooted got the same message. I uninstalled them both rebooted got the same message.

Location is Port_#0001.Hub_#0004 The other is Port_#0002.Hub_#0004

They both say no device driver installed I have searched online and on my computer for the drivers for this "Unknown Device" but no luck.

What do I do with this issue?

Please advise

[RKinner]

Right click on Computer and select Manage then Continue then Device Manager. You should see the unknown devices. Right click on each and select Properties then see if you can find the Hardware ID. I think it should show it under Details if you change the Properties line to say Hardware IDs.

Do you have any USB devices plugged in? Are they working?

[Ardant]

When I change them to Hardware ID all it says is USB\UNKNOWN

The Memory stick I was using when we first started this that was working no longer is

[RKinner]

How about Device Instance instead of Hardware ID.

[Ardant]

USB\VID_0000&PID_0000\5&52B535B&0&1

Even when I remove the items from my computer I get the USB Device Not Recognized warning.

[RKinner]

That ID means failed enumeration so let's try reinstalling the USB.

Right click on (My) Computer and select Manage (Continue) Then Device Manager. View, Show Hidden Devices.

Now in the right pane find Universal Serial Bus Controllers and click on the arrow in front of it to open it up. Right click on each device you see below Universal Serial Bus Controllers and Uninstall. Reboot when done. Windows will rediscover them and reinstall. Sometimes that will fix the problem.

[Ardant]

The problem is still there. The computer seems to be working but I still get the messages etc.

[RKinner]

I'm going on a trip today for 10 days so won't have much time to work on this and it's not really my field. You might have better luck starting a new post in our Vista/Win 7 forum:

http://www.geekstogo...-and-windows-7/

Put in a link to this post so they can see what we have done.

Ron