My husband's Asus laptop sounds like it's playing a radio

[Evenshade]

Service Pak 1 successfully installed!!! :dance:       We did it!

Thank you!

[DonnaB]

Oh my goodness, gracious!!! Now is the time that I would love to have one of those little smilie faces that does cartwheels!! Guess I'll have o settle for bouncing to the moon and back.  :mitch: YIPPEE!! YAPPEE!! YAHOOEE!!

I'll bet your husband is doing the happy dance as we are.  :dance:

One more scan, if you would please, to check that everything is updated:

If you uninstalled Security Check, please install it again and provide the log it generates. If not, just click on the icon:

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document in your next reply.
  

Heading off to work in 15 mins. We'll remove our tools tonight.

You did a great job, Pam. Have a nice day and see you tonight!!

Donna :)

[Evenshade]

Here we go......   :smiley:

Results of screen317's Security Check version 0.99.81 
Windows 7 Service Pack 1 x64 (UAC is enabled) 
Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````[/u]
Windows Security Center service is not running! This report may not be accurate!
Panda Cloud Antivirus   
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````[/u]
SpywareBlaster 5.0   
SUPERAntiSpyware Free Edition   
Adobe Flash Player 13.0.0.206 
Mozilla Firefox (28.0)
````````Process Check: objlist.exe by Laurent````````[/u] 
Microsoft Security Essentials msseces.exe
Windows Defender MSMpEng.exe
`````````````````System Health check`````````````````[/u]
Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````[/u]

[DonnaB]

Windows Security Center service is not running! This report may not be accurate!

Pam, the above is the only thing I'd like to double check. Please do the following and provide the results.

• Click on the Start and type cmd into the Start Search field.
  
• Click on cmd found under Programs 1.
  
• Type in tasklist /svc (please note the space between tasklist and /svc)
  
• Press the Enter key.
  

Next:

• Right click within the cmd prompt box and choose Select All.
  
• Right click again and this time choose Mark.
  
• Open Notepad, right click and choose Paste.
  
• Now, right click on what you just pasted to Notepad and choose Select All.
  
• Right click again and choose Copy.
  
• Paste the results into your next reply.
  

While you do that, I'll prepare my clean up tasks for you.    :)

[Evenshade]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Pam>tasklist /svc

Image Name                     PID Services
========================= ======== ============================================
System Idle Process              0 N/A
System                           4 N/A
smss.exe                       300 N/A
csrss.exe                      400 N/A
wininit.exe                    440 N/A
csrss.exe                      464 N/A
services.exe                   508 N/A
winlogon.exe                   540 N/A
lsass.exe                      568 KeyIso, SamSs
lsm.exe                        576 N/A
svchost.exe                    692 DcomLaunch, PlugPlay, Power
svchost.exe                    768 RpcEptMapper, RpcSs
MsMpEng.exe                    848 MsMpSvc
svchost.exe                    944 AudioSrv, Dhcp, eventlog, lmhosts
svchost.exe                    976 AudioEndpointBuilder, hidserv, Netman,
                                   PcaSvc, SysMain, TrkWks, UxSms, Wlansvc,
                                   wudfsvc
svchost.exe                   1012 AeLookupSvc, Appinfo, BITS, EapHost, gpsvc,
                                   IKEEXT, iphlpsvc, LanmanServer, MMCSS,
                                   ProfSvc, Schedule, SENS, ShellHWDetection,
                                   Themes, Winmgmt, wuauserv
svchost.exe                    348 EventSystem, netprofm, nsi, WdiServiceHost
svchost.exe                   1076 CryptSvc, Dnscache, LanmanWorkstation,
                                   NlaSvc
spoolsv.exe                   1344 Spooler
svchost.exe                   1376 BFE, DPS
taskhost.exe                  1548 N/A
dwm.exe                       1588 N/A
explorer.exe                  1616 N/A
taskeng.exe                   1692 N/A
AppleMobileDeviceService.     1708 Apple Mobile Device
wcourier.exe                  1736 N/A
ASPG.exe                      1748 N/A
ACMON.exe                     1760 N/A
sensorsrv.exe                 1776 N/A
ControlDeckStartUp.exe        1788 N/A
BatteryLife.exe               1804 N/A
mDNSResponder.exe             1976 Bonjour Service
svchost.exe                   2004 FDResPub, FontCache, SSDPSRV, upnphost
ACEngSvr.exe                  1444 N/A
svchost.exe                   2080 stisvc
SearchIndexer.exe             2468 WSearch
svchost.exe                   2528 PolicyAgent
ETDCtrl.exe                   2904 N/A
msseces.exe                   2912 N/A
notepad.exe                   3392 N/A
wmpnetwk.exe                  3592 WMPNetworkSvc
svchost.exe                   4012 SDRSVC
dllhost.exe                   1520 COMSysApp
msdtc.exe                      640 MSDTC
wuauclt.exe                   2812 N/A
audiodg.exe                   1984 N/A
firefox.exe                    904 N/A
plugin-container.exe          3088 N/A
FlashPlayerPlugin_13_0_0_     2488 N/A
FlashPlayerPlugin_13_0_0_     2116 N/A
cmd.exe                       3020 N/A
netsession_win.exe            3424 N/A
netsession_win.exe            3528 N/A
cmd.exe                       1724 N/A
conhost.exe                   2604 N/A
tasklist.exe                  4056 N/A
WmiPrvSE.exe                  3376 N/A

C:\Users\Pam>

[DonnaB]

Ok, Pam? I'm looking to see if the Security Center service is running (wscsvc) and I don't see it in the list of services running. I'm going to have you go into services manually and double check for me, if you would please:

• Click on your Start and type services.msc into the Start Search field.
  
• Click on Services found under  Programs 1
  
• Expand the Services screen to maximum and click on the Standard tab at the bottom.
  
• Place you cursor on the little line between Name and Description at the top and drag the two "tabs" apart to get a better view for the names of the Services.
  
• Scroll downward and look for Security Center.
  
• Under the Status column it should read Started and under the Startup Type it should read Automatic (Delayed Start). (You may need to drag the other columns apart to get a full view of that info ).
  

If the settings above are not what they should be, please do the following:

• Double click on Security Center.
  
• In the window that pops up, look for Start type: and click on the drop down arrow to the right and choose Automatic (Delayed Start) from the list.
  
• Now, look further down the window and click on the Start button.
  

Probably would hurt to reboot the laptop. Then provide another log for my viewing pleasure.

Thank you! :)

[Evenshade]

Hi Donna,
there was nothing in the Status column and in the Startup Type column was the word "disabled", so I did have to go to Startup type: and change the setting to  Automatic (Delayed Start).  I have done that, but........

Under Service Status: Stopped, the Start button is grayed out. 
You're earning your money here! < ggg >

[Evenshade]

I decided to be brave and press "Apply" and it worked.  :)

Here's the new log:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Pam>tasklist /svc

Image Name                     PID Services
========================= ======== ============================================
System Idle Process              0 N/A
System                           4 N/A
smss.exe                       300 N/A
csrss.exe                      400 N/A
wininit.exe                    448 N/A
csrss.exe                      464 N/A
services.exe                   508 N/A
winlogon.exe                   540 N/A
lsass.exe                      568 KeyIso, SamSs
lsm.exe                        576 N/A
svchost.exe                    680 DcomLaunch, PlugPlay, Power
svchost.exe                    760 RpcEptMapper, RpcSs
MsMpEng.exe                    836 MsMpSvc
svchost.exe                    912 AudioSrv, Dhcp, eventlog, lmhosts
svchost.exe                   1012 AudioEndpointBuilder, hidserv, Netman,
                                   PcaSvc, SysMain, TrkWks, UxSms,
                                   WdiSystemHost, Wlansvc, WPDBusEnum, wudfsvc
svchost.exe                    320 Appinfo, EapHost, gpsvc, IKEEXT, iphlpsvc,
                                   LanmanServer, MMCSS, ProfSvc, Schedule,
                                   SENS, ShellHWDetection, Themes, Winmgmt
audiodg.exe                    348 N/A
svchost.exe                    328 EventSystem, netprofm, nsi, WdiServiceHost,
                                   WinHttpAutoProxySvc
svchost.exe                   1156 CryptSvc, Dnscache, LanmanWorkstation,
                                   NlaSvc
spoolsv.exe                   1308 Spooler
svchost.exe                   1336 BFE, DPS
taskeng.exe                   1400 N/A
taskhost.exe                  1508 N/A
dwm.exe                       1664 N/A
explorer.exe                  1760 N/A
AppleMobileDeviceService.     1820 Apple Mobile Device
mDNSResponder.exe             1872 Bonjour Service
svchost.exe                   1900 FDResPub
svchost.exe                   1952 stisvc
svchost.exe                   1080 PolicyAgent
TrustedInstaller.exe          2124 TrustedInstaller
taskeng.exe                   2344 N/A
wcourier.exe                  2400 N/A
ASPG.exe                      2412 N/A
ACMON.exe                     2424 N/A
ControlDeckStartUp.exe        2444 N/A
sensorsrv.exe                 2452 N/A
BatteryLife.exe               2464 N/A
ACEngSvr.exe                  2572 N/A
svchost.exe                   2656 WerSvc
SearchIndexer.exe             2892 WSearch
ETDCtrl.exe                   2976 N/A
msseces.exe                   2992 N/A
netsession_win.exe            3008 N/A
WmiPrvSE.exe                   708 N/A
netsession_win.exe            1656 N/A
cmd.exe                       2784 N/A
conhost.exe                   2968 N/A
tasklist.exe                   388 N/A

C:\Users\Pam>

[DonnaB]

Girl! You are as gutsy as I am!!  :wink:

I don't see wscsvc listed in the log though. Is the service started now??

[Evenshade]

It looks like it, Donna.  In the columns next to Security Center it says "started" and Automatic (Delayed Start)

[DonnaB]

It looks like it, Donna.  In the columns next to Security Center it says "started" and Automatic (Delayed Start)

Great!

Now, here's the best part!! Let's remove those tools, leftover files, etc., etc.....

Go ahead and keep McShield on your computer. If you would like, you could also install that program onto your husbands laptop, especially if he uses removable drives.

Next:

On the desktop right click and choose Delete for the following programs/setup files, if found:

FRST
FSS <- may have been uninstalled already.
Security Check
Panda UNINSTALLER07.exe
esetsmartinstaller_enu
windows6.1-KB976932-X64 -> SP1

Next:

Go to Start > Control Panel > Programs and Features and uninstall the following, if found:
ESET online scanner

Next:

Follow the path below and delete the folder (s), if found:
C:\Program Files (x86)\Panda Security
C:\Program Files (x86)\ESET

You may want to scout around a bit at this time and look for any logs that might be left behind.

We never did clear out the temp files. I like to recommend a program by OldTimer called TFC (Temporary File Cleaner).

TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB).

Before running, it will stop Explorer and all other running applications. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.
-- TFC only cleans temp folders.
-- TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail.

TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

Instructions to install TFC:

Download TFC by Old Timer from here:

• First, save any files as TFC will close ALL open programs including your browser!
  
• Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
  
• Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
  
• Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete cleaning.
  

Keep MBAM version 2 installed and run that program at least once every two weeks. Once a week if the laptop is used heavily every day. Less if rarely used. Same with TFC above.

For basic maintenance:

Depending on how much you use your computer you should keep it in tip top shape by performing basic maintenance on a daily/weekly/monthly basis.

1.) TFC
2.) Disk cleanup which is included in Windows.
3.) Windows Defrag, which is included with Windows as well.

And just to add, the Windows Operating Systems of today are a far cry from the ones of the past. Windows is more robust, HDD's are bigger and better and most computer systems have more and better RAM as well as faster processors. Windows handles temp files much more efficiently and doesn't store as many temp files that aren't needed like it used to. Disk cleaners have their place and are needed on occasion, just not as frequently as they once were needed.

And finally! Some more of my very own tips for safe computing:

• Make sure Realtime AV scanning is enabled.
  
• Don't trust pop-ups that tell you that you may have spyware on your machine. Most of these are money making schemes designed to get you to buy their removal product, which in some cases also contain malware.
  
• Make back-ups of your most personal files frequently by whatever means you have available, i.e. Tape, CD, DVD, USB Drives, Ghost programs, etc. You never know when you'll have to reformat and start from scratch and without current backups of your personal files, you're basically at a lose. You can always reformat and reinstall programs, but you cannot replace your data if you haven't made backups.
  
• Be careful where you "surf". If you know you are going to click a site that is questionable, then at least be intelligent enough to disable javascript, java, ActiveX installations, etc... You "surf" these sites at your own risk.
  
• Uninstall and quit using P2P networking programs like uTorrent, Kazaa, BearShare, eMule and Limewire. These are your most likely weakest links if you're using them. Primarily most stuff transferred is illegally obtained and if you won't give it up you eventually pay the consequences.
  
• Don't give access to your computer to friends or family who appear to be clueless about what they are doing. Otherwise you'll come home from school/work one day and your computer will be trashed.
  
• In my opinion, a PC is just that, a PC (Personal Computer). Don't allow your children to talk you into any Windows cracks, hacks, or tweaks that could turn your computer into an expensive doorstop.
  
• When in doubt -- don't download it and don't install it until you've researched it.
  

Here is a link that you might find interesting that will educate and enhance your online surfing abilities by Tony Klein and kept updated by our very own Corrine:

"So how did I get infected in the first place?"

Pam, if you have any questions or concerns please don't hesitate to ask! Any member on this site will be more then happy to guide you in your quest for safe surfing and to prevent infection. It's been a pleasure helping you.

Happy and safe computing!

Donna :)

[Evenshade]

Hi Donna!
I hope you don't think I deserted you....I've been away at a conference since Sunday morning and just got home.  Thank you so much for all you've done for us.  It's truly been my pleasure to work with you and we appreciate so much what you (and Corinne and Winchester) have done to help us. 

I'll go and finish up your instructions now.  Again....many thanks!
Pam and Dan

[DonnaB]

Hi Pam and Dan,

My apologies for the delay in replying. Work has consumed my time as well.

You are very welcome. It was a pleasure helping you and Dan. Any time you have questions or concerns, don't hesitate to ask for our help. Anyone of the members here at LzD would be more than happy to help. :)

Be safe, and have a great Mothers Day.

Donna :)