[megwin02]

HI,
Thanks for your help in advance. I just have a quick question. Can not seem to get a direct answer from Windows Help screens..If I am running with McAfee Security Protection, also with SuperAntiSpyware & Malwarebytes Anti-Malware(thanks to someone from tech support for the Malwarbytes) do I need the Windows Defender Program running and/or Windows Security Program running?? First in the help screens it says no, but for Defender it says yes. Have cleaned up computer pretty good(i think) so don't want anything else to get screwed.
I have a HP Pavilion dv9727cl notebook with Vista home premiem 32 bit with a AMD Turrion 64x2.
Thanks again, just am so paranoid something will or could still be wrong>

[flavallee]

meg:

Click Start - Run, type in SERVICES.MSC and then click OK.

Expand the services window so you can see the list clearly.

There should be 2 entries:

Security Accounts Manager

Security Center

They should already be set on "Automatic" and should show a status of "Started".

You want them to remain this way so the Security Center is always active.

-----------------------------------------------------------------

You don't need Windows Defender running, especially since you have Malwarebytes Anti-Malware and SUPERAntiSpyware installed.

Right-click that entry in the services window and then click Properties. Change the "Startup Type" from "Automatic" to "Disabled" and then click Apply - OK.

Close the services window and then restart your computer.

----------------------------------------------------------------

[megwin02]

Hey Flavallee,
Thanks both of those were disabled. Not sure how I have never even seen that screen before.(and to think I thought I was at least a intermediate computer user) Have learned quite a bit though in the last few weeks! I have written in a special notebook everything you have told me to do so far, everything I did and saved all logs) Still feel like stuff that should be running might not be or should run at startup and is not?? I read through that whole list and noticed some items that are disabled that I would think should be automatic or manual. Can I send you what I wrote down(if you don't mind) or can that list be copied and pasted here? Just feel like simple things are still wrong from my huge mistake and stuff is disabled after I did the system restore point?? Sorry so long and thank you for past help and this problem. Shouldn't of taken what you said so personal
thanks again

[flavallee]

I wonder how the Security Accounts Manager and Security Center service entries got set to "Disabled"? At least you have them set to "Automatic" now.

-----------------------------------------------------------------

Any service entry in your list that's currently set to "Disabled", change it to "Manual", then click Apply - OK. After you're done, restart your computer.

After your computer has completely settled down and nothing is still loading and running, go back into the services list. If any service entry currently set to "Manual" shows a status of "Started", change it to "Automatic". There's no need to restart again.

-----------------------------------------------------------------

[megwin02]

OK won't be leaving now had to do homework with kids..about to do what you just posted...about Security manager and center I could not of even done it on accident, have never even seen that page before and I do have enough sense to never change security settings without a trusted source telling me I need to. maybe from powersuit or when i did system restore date??

[megwin02]

Hey Flavallee,
Gosh some took a little time to switch. Hopefully I made the right decision..changed all of them like you said with the exception of windows defender and windows firewall. IS that right, McAfee says, I believe that I shouldn't run 2 firewalls, they can conflict with each other that I shouldn't enable windows firewall?? you agree? I have never had it running since I got my laptop. McAfee disables it when you first install in the default setting..I believe. Not that I don't trust you (have heard nothing but good comments about Tech Support) but without seeing the list of what was disabled, how do you know?? Not doubting you, just curious. I will be up all night studying right in this spot finally! Thanks again so much for your help and patience
Meg

[flavallee]

meg:

I personally use the built-in Windows firewall and don't use a third-party firewall. The install of a third-party firewall usually disables the built-in Windows firewall, so leaving that entry on "Disabled" is okay.

---------------------------------------------------------------

Do you know how to post a HijackThis log here?

---------------------------------------------------------------

[megwin02]

hey,
thanks for reply. I have been in school all day. I think I know how, let check it out real quick and I willl let you know.
Thanks again for your help
meg

[flavallee]

Go here and click the green icon to download HijackThis 2.0.2.

Close all open windows, then install it in its default location: C:\Program Files\Trend Micro\HijackThis.

Run a scan with it - which will take 30 seconds or less.

Save the resulting log in Notepad.

Return here, then copy-and-paste the entire log here.

--------------------------------------------------------------

[megwin02]

I already have HijackThis I was looking for the log from before to see what the date was. Doing it now..

[megwin02]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:49:22 PM, on 11/4/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\windows sidebar\sidebar.exe
C:\Program Files\windows sidebar\sidebar.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10c.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.aol.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80016
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://toolbar.inbox.com/help/sa_cus...spx?tbid=80016
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://toolbar.inbox.com/search/ie.aspx?tbid=80016
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://toolbar.inbox.com/help/sa_cus...spx?tbid=80016
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_A54B7D6FB1DA63EA.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: *.mathxl.com
O15 - Trusted Zone: http://*.mcafee.com
O15 - Trusted Zone: *.myitlab.com
O15 - Trusted Zone: *.pearsoncmg.com
O15 - Trusted Zone: *.pearsoned.com
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...Uploader55.cab
O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} (Diagnostics ActiveX WebControl) - http://support.microsoft.com/mats/DiagWebControl.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Bejeweled.../armhelper.ocx
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Spiceworks (spiceworks) - Unknown owner - C:\Program Files\Spiceworks\bin\spiceworks.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 9840 bytes

[megwin02]

I am comfused cause there is stuff there I dont use or nver seen before? Like a bunch of toolbars and Game console Only things I do that I am pretty careful about is My aol homepage and IGoogle page. I like certain widgets for my pages and some in IGoogle I have to have for school. I even got rid of bunch of stuff that I didn't use or want or had never even seen before. Most of my gagets on those pages I have had for a long time and there has never been any issues like this till now

[flavallee]

meg:

Browse through your "Programs And Features" list and write down the list of toolbars and games and other programs that you don't use or recognize, then post that list here in a vertical column.

Don't bother to write down anything that's related to Microsoft or Windows programs and updates and hotfixes.

---------------------------------------------------------------

I'm going to reply back to you in a separate message window with instructions on how to trim down the startup load of its unnecessary running programs and services.

---------------------------------------------------------------

[flavallee]

meg:

Follow these instructions carefully and take your time.

Click Start - Run, type in MSCONFIG and then click OK - Startup(tab).

Remove the checkmark in(.exe may not be present in the name):

HP Health Check Scheduler c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

Adobe Reader Speed Launcher C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

Adobe ARM C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

SunJavaUpdateSched C:\Program Files\Java\jre6\bin\jusched.exe

QuickTime Task C:\Program Files\QuickTime\QTTask.exe

iTunesHelper C:\Program Files\iTunes\iTunesHelper.exe

ehTray.exe C:\Windows\ehome\ehTray.exe

After you're done, click Apply - OK - Exit Without Restart.

Click Start - Run, type in SERVICES.MSC and then click OK.

Expand the services window to see the list more clearly.

Double-click on(or right-click on and then click Properties) on:

ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc.

Apple Mobile Device - Apple Inc.

Bonjour Service - Apple Inc.

Com4Qlb - Hewlett-Packard Development Company, L.P.

GameConsoleService - WildTangent, Inc.

Google Update Service (gupdate) (gupdate) - Google Inc.

Google Software Updater (gusvc) - Google

HP Health Check Service - Hewlett-Packard

hpqwmiex - Hewlett-Packard Development Company, L.P.

InstallDriver Table Manager (IDriverT) - Macrovision Corporation

iPod Service - Apple Inc.

NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation

Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner

Spiceworks (spiceworks) - Unknown owner

Viewpoint Manager Service - Viewpoint Corporation

XAudioService - Conexant Systems, Inc.

If "Startup Type" is set on Automatic, change it to Manual, then click Apply - OK.

After you're done, close the services window, then restart your computer.

Start HijackThis and run a scan, then post that new log here.

-----------------------------------------------------------------

What peripherals(printer, scanner, iPod, camera, etc.) do you use with or have connected to this computer?

----------------------------------------------------------------