[q11]

Help Please,

I would like to update Java. I deleted Java 2 RunTime Env, SE v1.4.

In removing older versions of Java, do I delete Java(TM) 6 update 3 contained in ADD or Remove Programs, keep it or delete it???

What Java do I keep as there still remains Java Control Panel in the Control Panel folder. Do I delete that as well before I download the latest version of Java SE Runtime Environment JRE 6 Update 17???

Not sure what Java to keep or delete before downloading the latest Java version.

Thanks,
q11

[midders]

Java normally updates over the top of an existing install without any problems. If you get problems after updating, only then bother with a clean install.

Slainte

midders

[flavallee]

q11:

Follow these steps:

Download and save version 1.6.0.17.

Go into the Add Or Remove Programs list and uninstall ALL older versions of java still present - regardless of whether they're version 1.4, 1.5, or 1.6.

Restart your computer.

Go into the C:\Program Files\Java folder and delete any leftover folders still present.

Install version 1.6.0.17.

-------------------------------------------------------------

[q11]

flavallee,

Thanks a lot! The only file in C:\Program Files\Java folder is JAVA SE RUNTIME ENVIRONMENT (JRE) VERSION 6. Is that the correct Java?

Again thanks,
q11

[q11]

flavallee,

Your advice please. The computer will not restore to any past restore dates. I've tried several SR points in both Normal & Safe Modes. The SR goes thur the proccess completely with no hang ups or errors; however, the same message appears after each reboot:

"Incomplete Restoration"

Your computer cannot be restore to: Saturday October 17, 2009 (any past restore dates)
System Checkpoint

No changes have been made to your computer
-------------------------------------------------------------------
I have in the past restored the computer to a past point successfully; it has been a while, though.

I do appreciate your help,
q11

Below is a current Hijackthis and msinfo32

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:00 PM, on 11/9/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4254E07D-1B18-446C-BA07-20A70E629F88} - C:\PROGRA~1\AEVITA~1\SAVEFL~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &AEVITA Save Flash - {33973600-925A-11D9-A1F6-9234C84D2622} - C:\PROGRA~1\AEVITA~1\SAVEFL~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: AEVITA Save Flash - {0C4D904C-697B-4F51-B82F-D5D8D8D36405} - C:\PROGRA~1\AEVITA~1\SAVEFL~1.DLL
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=laptop
O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h50203.www5.hp.com/HPISWeb/Cu...ataManager.CAB
O16 - DPF: {5ACAA414-FCF1-468F-9442-71A7B6D2079E} (CitrixActivator Control) - https://www.myswa.com/maestroap_if/CitrixActivator.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 5625 bytes
----------------------------------------------
Below is msinfo32, for more info:

OS Name Microsoft Windows XP Home Edition
Version 5.1.2600 Service Pack 2 Build 2600
OS Manufacturer Microsoft Corporation
System Name YOUR-410E587B6
System Manufacturer Hewlett-Packard
System Model HP Pavilion dv1000 (PR428UA#ABA)
System Type X86-based PC
Processor x86 Family 6 Model 13 Stepping 6 GenuineIntel ~1695 Mhz
BIOS Version/Date Hewlett-Packard F.13, 12/17/2004
SMBIOS Version 2.31
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)"
Time Zone US Mountain Standard Time
Total Physical Memory 512.00 MB
Available Physical Memory 128.26 MB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.96 GB
Page File Space 1.09 GB
Page File C:\pagefile.sys

[flavallee]

What was the reason for doing a System Restore?

All you had to do was delete the contents of the C:\Program Files\Java folder before installing version 1.6.0.17.

--------------------------------------------------------------

[q11]

flavallee,

Recently, my laptop became infected. I ran Malwarebytes and Bitdefinder and they both got rid of the infection. After a few scans along with Kaspersky online scan, the computer came up clean.

I did run LSPfix to repair the connection problem that resulted from the bug. The laptop functions normal; however, this is what show up in the wbemess log file at different time intervals (see below); it started on the day the laptop got infected. As a result I became concern about the wbemess log file:

(Thu Nov 05 00:02:33 2009.10237218) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 00:04:28 2009.10351921) : Unable to register event source 'Service Control Manager' on server ''. Error code: 6B5
(Thu Nov 05 00:04:28 2009.10351937) : Event consumer provider is unable to instantiate event consumer NTEventLogEventConsumer="SCM Event Log Consumer": error code 0x80041001
(Thu Nov 05 00:04:28 2009.10352031) : Failed the first attempt to retrieve the sink to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 80041001.
WMI will reload and retry.
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:13 2009.63531) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:18 2009.67671) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:23:25 2009.74703) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 07:46:35 2009.1465406) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 08:39:55 2009.4665296) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Nov 05 09:18:00 2009.6949734) : NT Event Log Consumer: could not retrieve sid, 0x80041002

-------------------------------------------------------
Do you think the infection/bug had something to do with the computer not being able to restore to any past restore dates? Are there any corrupted files? How would I find corrupt files?

A thought, I do use CCleaner daily with checks in Windows Tab sections: Internet Explorer, Windows Explorer and System only, (no checks in Advanced section). Delete Index.dat files is also checked to clean.

Any chance of CCleaner having any impact to System Restore problem or the mysterious wbemess log issue?

Many thanks,
q11

[flavallee]

There is no need to use CCleaner daily. I wouldn't encourage a novice or inexperienced person to use it at all. It's too easy to use the wrong functions or delete the wrong things.

And don't rely on System Restore to be a miracle cure or bail you out of a problem. Half of the time it doesn't work right or work at all. I keep it disabled in my computers.

---------------------------------------------------------------

Let's see what's installed in that computer.

Open HijackThis.

Click on the "Open The Misc Tools Section" button.

Click on the "Open Uninstall Manager" button.

Click the "Save List" button.

Save the "uninstall_list.txt" file somewhere. It'll then open in Notepad.

Return here to your thread, then copy-and-paste the entire file here.

--------------------------------------------------------------

[midders]

Originally Posted by flavallee

And don't rely on System Restore to be a miracle cure or bail you out of a problem. Half of the time it doesn't work right or work at all. I keep it disabled in my computers.

I second that; you're much better off making backups with a 3rd party tool such as Macrium Reflect. Also, keep your eyes peeled on Comodo "Time Machine", a windows equivalent for the popular Mac software that is currently in beta testing.

[q11]

flavallee,

The Hijack file:

Adobe Flash Player 10 ActiveX
Adobe Reader 6.0.1
AEVITA Save Flash version 1.5
avast! Antivirus
AVG Anti-Rootkit Free
CCleaner (remove only)
CDex extraction audio
Citrix ICA Web Client
Conexant AC-Link Audio
DivX
DivX Player
HijackThis 2.0.2
HP Help and Support
ieSpell
Intel(R) Extreme Graphics 2 Driver
InterVideo WinDVD
Java(TM) 6 Update 17
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Office Standard Edition 2003
Microsoft Works
MSN Music Assistant
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Orbit Downloader
Quick Launch Buttons 5.00 C2
QuickTime
Real Alternative 1.50
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
SoftV92 Data Fax Modem with SmartCP
Sonic RecordNow!
Sonic Update Manager
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515 drivers.
Tiny soft
UniPrint
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893086
Zone Deluxe Games

Thanks,
q11

[flavallee]

AVG Anti-Rootkit Free is very outdated and useless, so uninstall it.

You already have Malwarebytes Anti-Malware - which is good. If you haven't updated it in awhile, do so.

Also download and install SUPERAntiSpyware 4.29.0.1004.

MBAM and SAS used on a regular basis will do a very good job of keeping the "nasties" in check in your computer. They're both very user-friendly and work well together.

-------------------------------------------------------------

[q11]

flavallee,

Before I run SUPERAntiSpyware 4.29.0.1004, do I need to turn off avast! Anti-virus protection? If so how do I turn it off? Do I need to turn off Malwarebytes Anti-Malware, too?

Thanks
q11

[flavallee]

You shouldn't have to turn off Avast4 first. I don't turn off AVG9 first when I run a scan with MBAM and SAS.

Update MBAM and run a quick scan with it first, then fix EVERYTHING it finds, then restart.

Update SAS and run a quick scan with it second, then fix EVERYTHING it finds, then restart.

If you know how to post their scan logs here afterwards, do so, otherwise I can give you instructions.

------------------------------------------------------------

[q11]

flavallee,

I will run both scans tonight.

Thanks,
q11

[flavallee]

There's no hurry. I'm going off-line shortly. I'll check back with your thread tomorrow morning.

-----------------------------------------------------------------