i have no idea where to begin...

puterbooboo · May 20, 2007

i have no idea where to begin...nor what the real problem is. My computer is not working even enough to get to this website(i am at a friends right now). I have norton antivirus and have run it but it shows no viruses.

There are a few things happening:

1. i can't get onto any websites anymore 2 different messages that come up they are either "address is not valid" or "internet explorer cannot display the web page"

i am connected to the internet so i don't understand why this is happening.

2. Window media player won't work

the error reads " windows media player cannot play the file because there is a problem with your sound device.there might not be a sound device installed on your computer, it might be used by another program or it might not be functioning properly"

3. the taskbar blinks and changes from the original color to white

all this started happening last week and i can't figure it out . I can't even go to get updates for the windows or my norton antivirus. I am stumped if anyone can tell me what to do please??? I would greatly appreciate it.

chaslang · May 21, 2007

Welcome to Major Geeks!

What operating system do you have (Win XP, Win 2K, Win ME, Win 9x)?

Can you download on your friends PC and then burn to CD or a flashdrive and then copy to your PC?

Does you PC work better in safe boot mode?
Can you connect to the internet in safe mode? If so, can you download in safe mode?

If you have Windows 2000 or Windows XP, look for the below file and delete it:

C:\windows\system32\drivers\etc\hosts

puterbooboo · May 26, 2007

Hi ty for your reply...didn't even know it posted as it said error

my operating system is Windows xp
I tryed downloading spybot etc. had a really hard time but eventually got it installed on my computer, i cannow get online but as soon as the computer is restarted the problem starts again. I always have to run spybot, and refix.

but i can't get windows media player to work at all. still can't do any updates

the problem that spybot keeps finding is :

microsoft.windowssecuritycenter_disabled Hkey_LOCAL_MACHINE\SYSTEM\currentcontrolset\wscsvc\start!=w=2

no I can't connect in safe mode either
should I still do as you suggested?
If you have Windows 2000 or Windows XP, look for the below file and delete it:

C:\windows\system32\drivers\etc\hosts

chaslang · May 27, 2007

Some form forms of wscsvc.exe are known to be a password stealing trojan. And other forms could just be Windows Security Center as you registry key from Spybot appears to indicate. If it is a password stealer, the below warning must be followed.

You are strongly advised to do the following immediately:

1. Disconnect infected computer from the internet and from any networked computers until the computer can be cleaned.

2. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

3. From a clean computer, change *all* your online passwords -- for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passords and transaction information.
Click to expand...

Now you need to do the below so we can get started and so we can figure out if you really have a problem. Right now I'm guessing that you do not have a problem and that you just have not allowed your browser to have access thru the Windows firewall (the firewall is part of the security center).

First get your PC to a useable state and do not reboot. Just do the below which come from the READ ME.

Download GetRunKey.Zip and ShowNew.Zip from the below links and extract all files from both ZIP files into a folder of their own. You can extract both ZIP files into the same folder. Like C:\MGTools While these tools will run from your Desktop, we strongly recommend that you DO NOT extract them to your Desktop. Please install them where recommended. Then run the scans as indicated on the download pages.

Using GetRunKey

Using ShowNew

Download HijackThis 1.99.1 make sure you use this link!!!! This is a self extracting executable which will default to installing it where want want it in C:\Program Files\HijackThis. Then just locate the HijackThis.exe file yourself and right click on it and select Rename. Rename is to analyse.exe This is very important since a few forms of malware will hide unless HijackThis is renamed.

Then attach a log from HijackThis!

See: HOW TO: Attach Items To Your Post

puterbooboo · May 26, 2007

Thanks again chaslang

ok here I go i hope I did this right i will try attach everything, please bear with me as most of this is foreign to me. I apologize ahead of time if i have done something wrong.

puterbooboo · May 26, 2007

one other thing i am curious about is if i have this password stealing trojan, how would i get it...doesn't norton and spysweeper protect me from those sort of things?

chaslang · May 27, 2007

puterbooboo said: ↑

one other thing i am curious about is if i have this password stealing trojan, how would i get it...doesn't norton and spysweeper protect me from those sort of things?
Click to expand...

Sometime yes, sometimes no! Many other people who had password stealers get installed asked the same thing! No protection software can protect you from things you may do yourself! Security begins with you!

You however do no have a password stealer installed. Your logs are clean.

You should uninstall the below old Sun Java versions:
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 2

puterbooboo · May 27, 2007

Thank you i removed those java updates.If the logs are clean...then i don't get what is causing problems for me. with the windows media, and the message spybot gives stating about the registry key.

puterbooboo · May 27, 2007

do i do as you said before?

If you have Windows 2000 or Windows XP, look for the below file and delete it:

C:\windows\system32\drivers\etc\hosts
Click to expand...

chaslang · May 27, 2007

puterbooboo said: ↑

If the logs are clean...then i don't get what is causing problems for me. with the windows media,
Click to expand...

Not malware. You should post exactly what your problem is in a message in the Software Forum. Tell them if you get sound from your PC from any other applications. Do you hear sound when Windows boots up? Perhaps you just need to reinstall your drivers for your sound card.

puterbooboo said: ↑

and the message spybot gives stating about the registry key.
Click to expand...

I think you are probably just getting a warning (not a malware indication) from Spybot that is telling you that the default settings for Windows Security Center have changed. This is normal when you install a program like Symantec because it is now your security center.

chaslang · May 27, 2007

puterbooboo said: ↑

Thank you i removed those java updates.If the logs are clean...then i don't get what is causing problems for me. with the windows media, and the message spybot gives stating about the registry key.
Click to expand...

No you don't need to do this anymore.

Log in or Sign up

i have no idea where to begin...

puterbooboo Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

puterbooboo Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

puterbooboo Private E-2

Attached Files:

newfiles.txt

runkeys.txt

hijackthis.log

puterbooboo Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

puterbooboo Private E-2

puterbooboo Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member